Federal Information Processing Standard (FIPS) - General Questions

Applicability

Windows OS Linux OS Splunk Enterprise

Description

The documentation in the "Securing Splunk Enterprise with FIPS" does not mention FIPS support, positive or negative, when working with a Windows environment, only Linux. 

Investigation

Please note: 
FIPS mode is configured at the Splunk level so it can be used in any OS.

 

Resolution

Please find below answers related to different FIPS case scenarios: 
 

A) How to enable FIPS mode?

Always enable FIPS mode upon initial Splunk software installation. When installing the software without FIPS mode enabled, it cannot later upgrade to a FIPS version and must either reinstall or install a new version.

Follow the next steps: 

1. Before starting Splunk Enterprise for the first time, use a text editor to edit the $SPLUNK_HOME/etc/splunk-launch.conf configuration file.

   Add the following line to the file:

   SPLUNK_FIPS=1
   

B) Does it change indexes if FIPS mode is enabled? 

When running Splunk in FIPS mode, it does not alter indexed data in any way. Just copy indexes between FIPS and non-FIPS indexers.

C) What about SSL tools?

Splunk software ships with a recent version of OpenSSL at $SPLUNK_HOME/splunk/lib. For 6.0, Splunk supports OpenSSL with FIPS 140-2 enabled.

A variety of other SSL tools are available for purchase and download that can be used to create and set up certificates. If OpenSSL is used for certificate configuration, it is strongly recommended to use the version that ships with Splunk to avoid compatibility issues. To make sure that the version provided with Splunk software is used, set the environment to the version in  $SPLUNK_HOME/splunk/lib or $SPLUNK_HOME\splunk\bin for Windows:

The following is an example of the path for Windows (using the command prompt):

set PATH = %PATH%;%SPLUNK_HOME%\bin

D) Are Add-ons supported in FIPS mode? 

FIPS mode is not currently supported by all Splunk-supported add-ons. Some add-ons with modular inputs use an encryption algorithm to store credentials. This encryption algorithm is not supported when FIPS is enabled on the Splunk platform. In case it is required to use FIPS in the environment, the workaround for using this type of add-on is to install a heavy forwarder that is not using FIPS to perform data collection and then send that data to an indexer with FIPS enabled.

 

E) How to confirm FIPS mode status? 

Use the CLI, a REST endpoint, or a Splunk search to determine whether or not the Splunk instance is in FIPS mode.

• Run the following CLI command:

splunk show fips-mode -auth <username>:<password>

  If FIPS mode is enabled, the CLI command returns:

FIPS mode enabled

Otherwise, it returns:

FIPS mode disabled

 

• Run the following Splunk search:

| rest splunk_server=local /services/server/info | fields fips_mode

If FIPS mode is enabled, the search returns the following:

fips_mode
---------
        1

• The following command is to confirm if the FIPS mode is enabled at the OS level (Linux Only):

cat /proc/sys/crypto/fips_enabled 

IF is enabled the output will be: 

1

Please note:
Any Splunk apps in a FIPS-enabled instance must be certified to run in FIPS mode and cannot have dependencies on algorithms like MD5 or RC4.

Related Links

Splunk Documentation:
Securing Splunk Enterprise with FIPS
Add-ons and FIPS mode
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release