We received an error from our main search head(splunk1) when one of our indexers port 8089 connection was blocked to the license master.
Error screen shot is attached.
Unable to distribute to peer named splunk72-g2-inf at uri https://x.x.x.x because peer as status = 'duplicate license'. duplicate license hashes: ....long list of all the hashes.... Also present on the search head(splunk1.xxx.xxx.com)**
It appears that splunk search was disabled and dashboards were not coming up when this one indexer lost connection to the license master. I assumed that only that searches on that indexer would be disabled. Any ideas why this happened?
We currently just have a production pool with all the indexers, and search heads assigned to a single pool.
It appears the search head was trying to take over as the license master, maybe due to a loss of connectivity. I would ensure that the search head in question is a slave to the license master.