Why do I get this "editTracker failed" error when trying to connect master instance (enterprise) and slave instance (trial)?

[DanielUhlmann]

So I tried to set up a new Splunk instance (currently trial version) and I want that instance to be a splunk slave from a master (enterprise version) in another network. I already tried to setup a A-Record for this: IP -> example.com to reach the master splunk instance from my trial license. But every time I try , this error appears:

Splunk  7.1 Bad Request — editTracker failed, reason='Unable to connect to license master=https://example.de:8089 Error resolving: Name or service not known'

Am I still missing something? Thanks in advance.

kind regards,

Daniel

[mstjohn_splunk]

Hi @danieluhimann. Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues.

[3no · Accepted solution]

Yes that's your problem :

"A license master must be of an equal or later version than its license slaves."

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurealicensemaster

[DanielUhlmann]

Okay yes this is a problem, indeed. But Splunk don't try to connect to the master anyway? Or am I wrong?

[3no]

I'm not sure, how it act in this case. But yeah, I would exept the slave at least to try to connect...

[DanielUhlmann]

I really dont know what to do anymore. I dont think that this is the version problem at this point...

[3no]

You will have to upgrade your master or downgrade your slave in any case.
So I guess, you should at least give it a try with the same version.

Hope, it will work for you.

[3no]

Hi,

nslookup example.de 

Does this command return you the IP of the master ?

If no you have a communication problem with you DNS, maybe try adding the record directly in /etc/hosts.

3no.

[DanielUhlmann]

Hey @3no

yes I receive the master IP with nslookup. I figured out, that my splunk (not the master one) always try to connect against himself (127.0.0.1). You know how I can fix this? Because there is not a single packet going out to the slave (with tcpdump). Also added the entry directly in /etc/hosts.

[3no]

wieird... maybe you have a firewall between or an iptable ?

If you go to $SPLUNK_HOME/etc/system/local and take a look at server.conf, you should see this lines :

[license]
master_uri = https://example.de:8089

[3no]

Also can you ping the master from the slave, maybe it's a routing problem ?

[DanielUhlmann]

I checked everything. Seems okay for me... My master version is older than my slaves one. Is this a problem?