How to connect a clustered indexer deployment to the License Master of a non-clustered deployment?

[Glasses]

I have a non-clustered splunk enterprise deployment (1) , where 1 of the 3 indexers is the License Master.

I have another clustered splunk enterprise deployment (2) that I must configure to contact the LM of  deployment (1).

I tried connecting the LM of 2 to LM of 1, and that did not work.  The connection was successful and it appeared the LM2 was checking in, but the license usage was not correct.  Eventually deployment 2 showed license warnings because the clustered indexers could not use the daisy-chained LM 2 to LM 1 connection.

Now I am looking for advice regarding connecting each of the individual (clustered) indexers in deployment 2 to LM of deployment 1.

Is there anything special that needs to be done when connecting clustered indexers individually to an LM in non-clustered deployment?

I would not think so, but any insight/previous experience with this is much appreciated.

Thank you

[richgalloway · Accepted solution]

As you discovered, licence managers (my term) cannot be daisy-chained. Connect the clustered indexers directly to the LM of 1. Nothing special is required, just make sure firewalls don't get in the way.

[Glasses]

Thank you for the decisive answer, I will try that again.

I previously had an issue when I did this.

The individual clustered indexers where showing an incorrect licensing usage.  

For example, if I have 4 clustered idxs and their daily use is 50 GB, I would normally see 12.5GB per idx.

But when I cut them over to the other LM, they displayed almost 50 GB each.

Maybe that was related to something else.

I will let you know how it goes.

Thank you

[Glasses]

I  need to wait a day to see if the license warnings clear first, I will get back to you once I complete the cut-over.

I think there was a license usage warning that caused an issue before.

When indexers cannot connect to a LM for a couple days and then they connect, does the usage aggregate from all the missed days to current day? causing an overage?

[Glasses]

Configuring the indexers (individually) to the new LM appears to be the only method that works.

Daisy-chaining LMs does not work.

Thank you.

[isoutamo]

Hi

all nodes must use the same pass4symkey under general stanza. And mgmt port must be open. Anyhow I prefer to use some other server than individual indexer as LM. E.g. CM is suitable candidate for that.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Configurealicensemaster

r. Ismo

[Glasses]

Thank you for the reply.

FYI- LM on an IDX was not my choice, inherited it that way, and we plan to cluster when we have the resources, and move the LM to a different server.

My deployments are still 7.x, the LM is 7.3.3.

Not sure the link you provided displays the pass4symkey info...

I tried LM clustered to LM un-clustered, network connection was good but licensing failed to distribute to the clustered indexers.

Now I am ready to configure each individual clustered indexer to the un-clustered LM.

But not sure if there is anything special I need to do.

Thanks