ERROR

[SN1]

One of my 5 indexer is getting this error
[MSE-SVSPLUNKI01] restricting search to internal indexes only (reason: [DISABLED_DUE_TO_GRACE_PERIOD,0])

I have some question .
1 . how do i check whether my indexer is connected with license master or not.
2.  if NOT then how can i connect them again.
3. And if the connection is good from start then what do I do next?

[livehybrid]

Hi @SN1 

Did you see the responses to your previous post about this on Friday? 
https://community.splunk.com/t5/Splunk-Search/Error/m-p/712793

Did any of these solutions work for you?

It sounds like your license has expired or not installed correctly.

Go to https://yourSplunkInstance/en-US/manager/system/licensing and check that the license is showing as valid.

Are you expecting your instance to be connected to a License Server, or does it have its own license installed? Can you reach the license server (if applicable) from the problematic server using netcat? (nc -vz -v1 <serverIP> 8089) 

Once you have confirmed let us know and we can look at a tweaked method for further investigation!

If your license isnt showing here, or if it cannot connect to your license server (if applicable) then you will need to resolve this before being able to search non-internal indexes.

[kiran_panchavat]

@SN1 Check this https://community.splunk.com/t5/Splunk-Search/Receiving-quot-DISABLED-DUE-TO-GRACE-PERIOD-quot/td-p/... 

[kiran_panchavat]

@SN1 

From the indexer, check network connectivity to the license master

ping <license-master-ip>
telnet <license-master-ip> 8089

If it fails, there’s a network issue (firewall, DNS, etc.).

Check DNS resolution if you’re using a hostname for the license master:

nslookup <license-master-hostname>

If it doesn’t resolve, DNS might be the problem.

[kiran_panchavat]

@SN1 

This error typically indicates that the indexer is unable to communicate with the license master or there’s a licensing issue affecting its operation.

You can run this query on the License Master servers to find host name/IP of the Indexer (license slaves) connecting to your License master.

| rest /services/licenser/slaves splunk_server=local | table title label | rename title as GUID label as Indexer

index=_internal component=Metrics group=tcpin_connections [| rest /services/licenser/slaves splunk_server=local | table title | rename title as guid ] | dedup sourceHost sourceIp | table sourceHost sourceIp hostname guid version os

[SN1]

so after running this query i am not able to see 1 indexer . How can i resolve it.

[kiran_panchavat]

@SN1 

To resolve the missing indexer in your License Master:

• Test network connectivity (ping, telnet 8089) between the indexer and License Master.
• Restart the indexer (and License Master if needed) after fixing config or network issues.
• Check if the indexer is running.
• On the indexer, open $SPLUNK_HOME/etc/system/local/server.conf and look for 

[license]
master_uri = https://<license-master-host>:8089

Replace <license-master-host> with the License Master’s IP or FQDN. If this is missing or incorrect, update it.

• From the indexer’s host : ping <license-master-host>
• Test the management port : telnet <license-master-host> 8089 . If it doesn’t connect, troubleshoot firewalls, network routes, or confirm the License Master is listening (netstat -tuln | grep 8089 on the License Master). 

[livehybrid]

Hi @SN1 
Are you able to share the output of this page from the server with an issue, please?

Go to https://yourSplunkInstance/en-US/manager/system/licensing 
Does the license is showing as valid?

Or does it show connection to license server?

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[kiran_panchavat]

@SN1  

The indexer can’t reach the License Master due to firewall rules, network outages, or DNS resolution problems. Please check with your network team.