Deployment Architecture

How to connect a clustered indexer deployment to the License Master of a non-clustered deployment?

Glasses
Builder

I have a non-clustered splunk enterprise deployment (1) , where 1 of the 3 indexers is the License Master.

I have another clustered splunk enterprise deployment (2) that I must configure to contact the LM of  deployment (1).

I tried connecting the LM of 2 to LM of 1, and that did not work.  The connection was successful and it appeared the LM2 was checking in, but the license usage was not correct.  Eventually deployment 2 showed license warnings because the clustered indexers could not use the daisy-chained LM 2 to LM 1 connection.

Now I am looking for advice regarding connecting each of the individual (clustered) indexers in deployment 2 to LM of deployment 1.

Is there anything special that needs to be done when connecting clustered indexers individually to an LM in non-clustered deployment?

I would not think so, but any insight/previous experience with this is much appreciated.

Thank you

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
As you discovered, licence managers (my term) cannot be daisy-chained. Connect the clustered indexers directly to the LM of 1. Nothing special is required, just make sure firewalls don't get in the way.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
As you discovered, licence managers (my term) cannot be daisy-chained. Connect the clustered indexers directly to the LM of 1. Nothing special is required, just make sure firewalls don't get in the way.
---
If this reply helps you, Karma would be appreciated.
0 Karma

Glasses
Builder

Thank you for the decisive answer, I will try that again.

I previously had an issue when I did this.

The individual clustered indexers where showing an incorrect licensing usage.  

For example, if I have 4 clustered idxs and their daily use is 50 GB, I would normally see 12.5GB per idx.

But when I cut them over to the other LM, they displayed almost 50 GB each.

Maybe that was related to something else.

I will let you know how it goes.

Thank you

0 Karma

Glasses
Builder

I  need to wait a day to see if the license warnings clear first, I will get back to you once I complete the cut-over.

I think there was a license usage warning that caused an issue before.

When indexers cannot connect to a LM for a couple days and then they connect, does the usage aggregate from all the missed days to current day? causing an overage?

 

 

0 Karma

Glasses
Builder

Configuring the indexers (individually) to the new LM appears to be the only method that works.

Daisy-chaining LMs does not work.

 

Thank you.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

all nodes must use the same pass4symkey under general stanza. And mgmt port must be open. Anyhow I prefer to use some other server than individual indexer as LM. E.g. CM is suitable candidate for that.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Configurealicensemaster

r. Ismo

0 Karma

Glasses
Builder

Thank you for the reply.

FYI- LM on an IDX was not my choice, inherited it that way, and we plan to cluster when we have the resources, and move the LM to a different server.

My deployments are still 7.x, the LM is 7.3.3.

Not sure the link you provided displays the pass4symkey info...

I tried LM clustered to LM un-clustered, network connection was good but licensing failed to distribute to the clustered indexers.

Now I am ready to configure each individual clustered indexer to the un-clustered LM.

But not sure if there is anything special I need to do.

Thanks

 

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...