Deployment Architecture

How to connect a clustered indexer deployment to the License Master of a non-clustered deployment?

Glasses
Builder

I have a non-clustered splunk enterprise deployment (1) , where 1 of the 3 indexers is the License Master.

I have another clustered splunk enterprise deployment (2) that I must configure to contact the LM of  deployment (1).

I tried connecting the LM of 2 to LM of 1, and that did not work.  The connection was successful and it appeared the LM2 was checking in, but the license usage was not correct.  Eventually deployment 2 showed license warnings because the clustered indexers could not use the daisy-chained LM 2 to LM 1 connection.

Now I am looking for advice regarding connecting each of the individual (clustered) indexers in deployment 2 to LM of deployment 1.

Is there anything special that needs to be done when connecting clustered indexers individually to an LM in non-clustered deployment?

I would not think so, but any insight/previous experience with this is much appreciated.

Thank you

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust
As you discovered, licence managers (my term) cannot be daisy-chained. Connect the clustered indexers directly to the LM of 1. Nothing special is required, just make sure firewalls don't get in the way.
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust
As you discovered, licence managers (my term) cannot be daisy-chained. Connect the clustered indexers directly to the LM of 1. Nothing special is required, just make sure firewalls don't get in the way.
---
If this reply helps you, Karma would be appreciated.
0 Karma

Glasses
Builder

Thank you for the decisive answer, I will try that again.

I previously had an issue when I did this.

The individual clustered indexers where showing an incorrect licensing usage.  

For example, if I have 4 clustered idxs and their daily use is 50 GB, I would normally see 12.5GB per idx.

But when I cut them over to the other LM, they displayed almost 50 GB each.

Maybe that was related to something else.

I will let you know how it goes.

Thank you

0 Karma

Glasses
Builder

I  need to wait a day to see if the license warnings clear first, I will get back to you once I complete the cut-over.

I think there was a license usage warning that caused an issue before.

When indexers cannot connect to a LM for a couple days and then they connect, does the usage aggregate from all the missed days to current day? causing an overage?

 

 

0 Karma

Glasses
Builder

Configuring the indexers (individually) to the new LM appears to be the only method that works.

Daisy-chaining LMs does not work.

 

Thank you.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

all nodes must use the same pass4symkey under general stanza. And mgmt port must be open. Anyhow I prefer to use some other server than individual indexer as LM. E.g. CM is suitable candidate for that.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Configurealicensemaster

r. Ismo

0 Karma

Glasses
Builder

Thank you for the reply.

FYI- LM on an IDX was not my choice, inherited it that way, and we plan to cluster when we have the resources, and move the LM to a different server.

My deployments are still 7.x, the LM is 7.3.3.

Not sure the link you provided displays the pass4symkey info...

I tried LM clustered to LM un-clustered, network connection was good but licensing failed to distribute to the clustered indexers.

Now I am ready to configure each individual clustered indexer to the un-clustered LM.

But not sure if there is anything special I need to do.

Thanks

 

 

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...