Hi, I have just enabled Data Block Signing on two of my indexes, but when I now try to verify them with "view" source the data shows up as "Detected possible tampering with this source.".
When enabling the data block signing I renamed the old indexes, added the renamed indexes to indexes.conf, and added blockSignSize = 100
to the (now empty) indexes.
Like this:
bin/splunk stop
mv 90d 90d-old
*edit indexes.conf adding blockSignSize=100 to 90d*
bin/splunk start
Thank you in advance
Espen