unable to distribute to peer duplicate license hashes

[sonicZ]

We received an error from our main search head(splunk1) when one of our indexers port 8089 connection was blocked to the license master.

Error screen shot is attached.

Unable to distribute to peer named splunk72-g2-inf at uri https://x.x.x.x because peer as status  = 'duplicate license'. duplicate license hashes: 

....long list of all the hashes.... 

Also present on the search  head(splunk1.xxx.xxx.com)**

It appears that splunk search was disabled and dashboards were not coming up when this one indexer lost connection to the license master. I assumed that only that searches on that indexer would be disabled. Any ideas why this happened?

We currently just have a production pool with all the indexers, and search heads assigned to a single pool.

[mwhite_splunk]

It appears the search head was trying to take over as the license master, maybe due to a loss of connectivity. I would ensure that the search head in question is a slave to the license master.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurealicenseslave

[sowings]

I've seen situations before where the licensing connection went wonky, and my (quick and dirty) solution was to take the indexer out of the pool, then add it back. YMMV.

[sonicZ]

Hi, well our license master shows the search head has been in the pool. Checking the search head licensing info definitely shows it as a slave to the master.