describes how to Work with signature validation files for upgrading

Download the universal forwarder's signature file. In splunk.com select your forwarder version, click "More" and select "Download x509 Signature". Note the following:

• Signature validation is mandatory.

• ​Only the universal forwarder version 9.0 and later are signed.​

​The Splunk Remote Upgrader for Windows Universal Forwarders performs validation with the universal forwarder package and signature file. ​

​To verify that you have the correct signature file, the signature filename should be the <universal forwarder package name>.sig. For example, if the universal forwarder package name is: ​

​splunkforwarder-9.3.2-d8bb32809498-Windows-x86_64.msi​

then the signature filename is: ​

​splunkforwarder-9.3.2-d8bb32809498-Windows-x86_64.msi.sig. ​