How to get a list of indexers reporting into our license manager via REST API?

[a212830]

Hi,

I want to get a list of indexers reporting into our license manager via REST API. Many of these we do not manage, but we are responsible for the license mgmt. I tried using | rest count=0 /services/licenser/slaves, but that also reports the heavy forwarder. Is there a way (via REST) to list only the indexers being reported on by the license manager? Something similar to what appears under the licensing page, under the license stacks.

Does the Heavy Forwarder need to be pointed at the license mgr if it's not indexing? Looking at this: https://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/TypesofSplunklicenses - it seems to indicate that isn't necessary. How would I "manually converted to the Forwarder license group" ?

[sloshburch]

What about a correlation of slaves from the REST endpoint that also show up in the license_usage.log during that time period. Wouldn't that show just splunk installs doing indexing?

[somesoni2]

You can enable the forwarder license on your Heavy forwarders by running following commands. Once they are converted to Forwarder License, they'll no longer be slave to License master and your rest api query would return only indexers.

$SPLUNK_HOME/bin/splunk edit licenser-groups Forwarder -is_active 1
$SPLUNK_HOME/bin/splunk restart

[a212830]

Tried that and received this:

[splunk@vlmmk301 bin]$ ./splunk edit licenser-groups Forwarder -is_active 1
Your session is invalid. Please login.
Splunk username: admin
Password:

In handler 'groups': no stacks/licenses corresponding to group=Forwarder

[somesoni2]

What version of Splunk are you using on your Heavy Forwarders?

Also, try adding this to server.conf on your heavy forwarder ($SPLUNK_HOME/etc/system/local/server.conf)

[license]
active_group =  Forwarder 

Restart Splunk afterwards.

[sloshburch]

If you use ./splunk list licenses you can see what's you've got to play with. Use ./splunk help list to see the list of options.

$ /opt/splunk_dev/bin/splunk edit licenser-groups Forwarder -is_active 1
The licenser-groups object has been edited.

That only worked on an instance where I had a Forwarder license stanza in my local/server.conf.

[lycollicott]

Try https://licenserhost:mgmtPort/services/licenser/slaves

(http://docs.splunk.com/Documentation/Splunk/6.5.0/RESTREF/RESTlicense)

[a212830]

I did | rest count=0 /services/licenser/slaves - same thing, no?

[lycollicott]

Yes, that will do the same thing.