topic Re: License Expired message while talking to license manager in Splunk Enterprise

License Expired message while talking to license manager

mattwhi — Mon, 07 Oct 2024 15:28:22 GMT

I have an enterprise deployment with multiple servers. All licensing is handled by a license manager. One of my indexers gives the warning "Your license is expired. Please login as an administrator to update the license." When I do, licensing looks fine. It's pointed to the correct address for the license manager. Last successful contact was less than a minute ago. Under messages it says, "No licensing alerts". And under "Show all configuration details" It lists recent successful contacts and the license keys in use. That's about as far as I can go because 30 seconds in, my session will get kicked back to the login prompt with the message my session has expired.

So, I have one server out of a larger deployment that seems to think it doesn't have a license. But all indications are that it does. But it still behaves like it doesn't.

Re: License Expired message while talking to license manager

sainag_splunk — Mon, 07 Oct 2024 16:05:19 GMT

Can you please provide your high level Splunk topology? How many components do you have ? is this clustered etc.

Did you try restarting Splunk from the backend?

Lookout the license files in $SPLUNK_HOME/etc/licenses

Re: License Expired message while talking to license manager

mattwhi — Mon, 07 Oct 2024 18:28:54 GMT

The indexers are clustered. I also have two search heads, a deployment server and an HF. The license manager server is offsite and held at a higher level organizationally speaking. I dont have direct access to it.

Did you try restarting Splunk from the backend?

Yes. That did not resolve it.

Lookout the license files in $SPLUNK_HOME/etc/licenses

I just see the temp trial license folder. I checked another server and see the same thing. Should there be anything else there?

Re: License Expired message while talking to license manager

sainag_splunk — Mon, 07 Oct 2024 20:41:19 GMT

Typically this is how we set up the license slaves. I recommend try the below.

By the use the CLI commmand on the bin directory on the indexer:

./splunk edit licenser-localslave -master_uri https://licensemaster:8089

Or you can update the server.conf file with:

[license]
master_uri = https://mylicensemasterserver:8089

Refer: https://docs.splunk.com/Documentation/Splunk/9.3.1/Admin/LicenserCLIcommands

I would recommend opening a support case if you are stuck even after this.

Hope this helps