Deployment Architecture

Splunk 7.3: Does an unavailable License Master still mean no searching is available?

perditi0nspam
Engager

Hi everyone,

According to the latest documentation:
https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/TypesofSplunklicenses

All new Splunk licenses are no-enforcement licenses (as of Splunk 6.5). However, as far as I can tell this no-enforcement policy doesn't exist if the License Server is down. If this server is down for 72 hours, search is no longer available.

Is this correct? If so, why is the no-enforcement policy true for licensing violations but not for a server being inaccessible?

Thanks!

0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

As @richgalloway mentioned, the no-enforcement clause is specified in the license file. If the license master goes down, and splunk isn't able to validate that a license exists, it'll assume you have no license (or only a free/trial license).

View solution in original post

jluo_splunk
Splunk Employee
Splunk Employee

As @richgalloway mentioned, the no-enforcement clause is specified in the license file. If the license master goes down, and splunk isn't able to validate that a license exists, it'll assume you have no license (or only a free/trial license).

sathwikr076
Communicator

Hello,

I have weird question here, the license master is not down but sometimes we are getting an error saying the indexers cannot contact the license master because max thread limit for REST HTTP server(license master) already in use. So in this case the ingestion and searching get effected or not. Please let me know.

Thanks.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Just a guess, but without a license master Splunk doesn't know if you have a no-enforcement license or not. The no-enforcement indication is in the license, not the code.

---
If this reply helps you, Karma would be appreciated.

perditi0nspam
Engager

Awesome, thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...