Following worked for me: $ cp /opt/splunk/etc/system/default/distsearch.conf /opt/splunk/etc/system/local/distsearch.conf $ chmod 640 /opt/splunk/etc/system/local/distsearch.conf $ cd /opt/splunk/etc/auth/distServerKeys $ mv private.pem private.pem_old $ mv trusted.pem trusted.pem_old $ splunk restart ... View more