Hi @dwaddle and others Im stuck with couple of questions and this thread is almost close to answer it. Im actually working on securing communication between Splunk nodes. I have 4 forwarders sending data to 3 indexers which is in cluster . I have a 1 deployment server to manage forwarders . and have 1 cluster master: Question 1 (securing forwarder->indexers): From the Splunk documentation and this thread i understand we need to have certificates for both forwarders and indexers. But don't understand why it is required on forwarders as well? Having certificates only in indexers does the job right? . Is it because of Splunk configuration or code demands to have it in forwarders as well? Question 2 (Cluster Master->indexers) : Since we have already in production , is there any impact or precautions that needs to be taken while making communication secured between CM and indexers. please share any link to document on the configuration . Thanks in Advance
... View more
