Getting Data In

How to get a list of indexers reporting into our license manager via REST API?

Champion

Hi,

I want to get a list of indexers reporting into our license manager via REST API. Many of these we do not manage, but we are responsible for the license mgmt. I tried using | rest count=0 /services/licenser/slaves, but that also reports the heavy forwarder. Is there a way (via REST) to list only the indexers being reported on by the license manager? Something similar to what appears under the licensing page, under the license stacks.

Does the Heavy Forwarder need to be pointed at the license mgr if it's not indexing? Looking at this: https://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/TypesofSplunklicenses - it seems to indicate that isn't necessary. How would I "manually converted to the Forwarder license group" ?

0 Karma

Ultra Champion

What about a correlation of slaves from the REST endpoint that also show up in the license_usage.log during that time period. Wouldn't that show just splunk installs doing indexing?

0 Karma

Revered Legend

You can enable the forwarder license on your Heavy forwarders by running following commands. Once they are converted to Forwarder License, they'll no longer be slave to License master and your rest api query would return only indexers.

$SPLUNK_HOME/bin/splunk edit licenser-groups Forwarder -is_active 1
$SPLUNK_HOME/bin/splunk restart
0 Karma

Champion

Tried that and received this:

[splunk@vlmmk301 bin]$ ./splunk edit licenser-groups Forwarder -is_active 1
Your session is invalid. Please login.
Splunk username: admin
Password:

In handler 'groups': no stacks/licenses corresponding to group=Forwarder

0 Karma

Revered Legend

What version of Splunk are you using on your Heavy Forwarders?

Also, try adding this to server.conf on your heavy forwarder ($SPLUNK_HOME/etc/system/local/server.conf)

[license]
active_group =  Forwarder 

Restart Splunk afterwards.

0 Karma

Ultra Champion

If you use ./splunk list licenses you can see what's you've got to play with. Use ./splunk help list to see the list of options.

$ /opt/splunk_dev/bin/splunk edit licenser-groups Forwarder -is_active 1
The licenser-groups object has been edited.

That only worked on an instance where I had a Forwarder license stanza in my local/server.conf.

0 Karma

Champion

I did | rest count=0 /services/licenser/slaves - same thing, no?

0 Karma

Motivator

Yes, that will do the same thing.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!