I tried to disable FIPS on Splunk forwarder as it looks like FIPS is disabled on Splunk cloud or indexer also any forwarder with FIPS turned on will fail to be allowed to connect. On the mis-configured forwarders disable FIPS and reboot. Check FIPS is disabled with the next command: cat /proc/sys/crypto/fips_enabled 0 https://docs.splunk.com/Documentation/Splunk/8.0.3/Security/SecuringSplunkEnterprisewithFIPS The Federal Information Processing Standard (FIPS) uses government-certified versions of some algorithms to meet regulatory guidelines. It should not be considered a security enhancement by itself, and might potentially reduce performance on your system. Enable FIPS if it is a regulatory requirement for your environment. Splunk Enterprise and the Universal Forwarder use an embedded FIPS 140-2-validated cryptographic module. Thus you need FIPS enabled and running on both the Forwarder side and the Indexer side ... View more