Hi All
Im stuck with couple of questions while i working on securing communication between Splunk nodes.
I have 4 forwarders sending data to 3 indexers which is in cluster . I have a 1 deployment server to manage forwarders . and have 1 cluster master:
Question 1 (securing forwarder->indexers): From the Splunk documentation we need to have certificates for both forwarders and indexers. But don't understand why it is required on forwarders as well? Having certificates only in indexers does the job right? . Is it because of Splunk configuration or code demands to have it in forwarders as well?
Question 2 (Cluster Master->indexers) : Since we have already in production , is there any impact or precautions that needs to be taken while making communication secured between CM and indexers. please share any link to document or list high level steps on the configuration .
Thanks in Advance
