I can find my Enterprise licence GUID in https://splunkcommunities.force.com, but when I look in my Splunk instance at Settings -> Licensing -> All licence details, all I can see is a licence Hash.
Does anyone know how I can relate the two so that I can finally work out which Splunk instance is using what licence please? This is a situation I have inherited from previous dev teams and so I don't have the full history of what was done when with what licence.
We don't have a complex setup, no forwarders or slaves, etc.
Any help would be much appreciated.
Allright, there is a naughty exploit that you can use for this.
This output contains your GUID and LicenseKey and LicenseSignature.
Does this help you?
There is an api call that gives you this information in a more standard way.
This will give you the guid, license hash, and you can tell if the server is a license manager or not by comparing the masterguid and slaveid fields. If they are the same, you are talking to your license manager, and if they are different, you are dealing with a server with a license managed by another server.
For license managers, you can call:
This will give expiration and start date info for all licenses that come with that server. Slave servers will not have any of this information here.