Deployment Architecture

Splunk 7.3: Does an unavailable License Master still mean no searching is available?

perditi0nspam
Engager

Hi everyone,

According to the latest documentation:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/TypesofSplunklicenses

All new Splunk licenses are no-enforcement licenses (as of Splunk 6.5). However, as far as I can tell this no-enforcement policy doesn't exist if the License Server is down. If this server is down for 72 hours, search is no longer available.

Is this correct? If so, why is the no-enforcement policy true for licensing violations but not for a server being inaccessible?

Thanks!

0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

As @richgalloway mentioned, the no-enforcement clause is specified in the license file. If the license master goes down, and splunk isn't able to validate that a license exists, it'll assume you have no license (or only a free/trial license).

View solution in original post

jluo_splunk
Splunk Employee
Splunk Employee

As @richgalloway mentioned, the no-enforcement clause is specified in the license file. If the license master goes down, and splunk isn't able to validate that a license exists, it'll assume you have no license (or only a free/trial license).

sathwikr076
Communicator

Hello,

I have weird question here, the license master is not down but sometimes we are getting an error saying the indexers cannot contact the license master because max thread limit for REST HTTP server(license master) already in use. So in this case the ingestion and searching get effected or not. Please let me know.

Thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Just a guess, but without a license master Splunk doesn't know if you have a no-enforcement license or not. The no-enforcement indication is in the license, not the code.

---
If this reply helps you, Karma would be appreciated.

perditi0nspam
Engager

Awesome, thanks!

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...