Splunk 4.2 and Broken Block Signatures

[Edub]

Have anyone else experience busted block signing in 4.2?

Every install of 4.2 we have is not executing the block signature.

We can't tell if it is just not signing the data or if the Show Source check is failing for another reason.

E.

[dwaddle · Accepted solution]

This seems to be covered as an open issue in the 4.2 release notes:

http://www.splunk.com/base/Documentation/4.2/ReleaseNotes/KnownIssues

BlockSignature content validation does not work with distributed search.

BlockSignature content validation does not work in 4.2 (GA), even without distributed search, and will falsely claim the data has been tampered with. (SPL-38082)