Hi @masakazu , I don't live in US so I never installed Splunk in FIPS Mode, but reading the related documentation ( https://docs.splunk.com/Documentation/Splunk/9.3.2/Security/SecuringSplunkEnterprisewithFIPs ), I don't see any known issue on ES or KV-Store. let us know if we can help you more, or, please, accept one answer for the other people of Community. Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 Ciao. Giuseppe ... View more

If you want to dynamically deploy the app to either the manager-apps or apps directory, you can use serverclass.conf on the deployment server to do this. Note that this is quite a complex deployment structure, make sure you keep your serverclass.conf well documented. Firstly, restore the CM's deploymentclient.conf's repository settings to default to enable the serverClass to control the target repository:   [deployment-client] repositoryLocation = $SPLUNK_HOME/etc/apps serverRepositoryLocationPolicy = acceptSplunkHome   Then on the DS you can then dynamically set the repositoryLocation using the targetRepositoryLocation  directive within serverclass.conf  at the serverClass level: For example you could have something like this:   [serverClass:CM_Deploy_to_Apps] whitelist.0 = cm.yourcompany.com targetRepositoryLocation = $SPLUNK_HOME/etc/apps stateOnClient = enabled [serverClass:CM_Deploy_to_Apps:app:example_app_1] restartSplunkd = true [serverClass:CM_Deploy_to_Apps:app:example_app_2] issueReload=true restartIfNeeded=true [serverClass:CM_Deploy_to_Manager_Apps] whitelist.0 = cm.yourcompany.com targetRepositoryLocation = $SPLUNK_HOME/etc/manager-apps stateOnClient = noop [serverClass:CM_Deploy_to_Apps:app:example_manager_app_1] [serverClass:CM_Deploy_to_Apps:app:example_manager_app_2]   ... View more

Hi @masakazu, in the deploymentclient.conf file of the Cluster Master, you have to add: repositoryLocation = $SPLUNK_HOME/etc/managed-apps in this way the deployment Server, only on the Cluster Master, doesn't deploy the apps into apps but in managed-apps folder. Then you have to push it by GUI (I'm not sure that's possible to automate it by DS). Put attention that this deploymentclient.conf must be different thant the one on the other clients. Ciao. Giuseppe ... View more

Please have a look at https://docs.splunk.com/Documentation/Splunk/9.2.0/Indexer/Configurethepeerindexes ... View more