Getting Data In

How to get a list of indexers reporting into our license manager via REST API?

a212830
Champion

Hi,

I want to get a list of indexers reporting into our license manager via REST API. Many of these we do not manage, but we are responsible for the license mgmt. I tried using | rest count=0 /services/licenser/slaves, but that also reports the heavy forwarder. Is there a way (via REST) to list only the indexers being reported on by the license manager? Something similar to what appears under the licensing page, under the license stacks.

Does the Heavy Forwarder need to be pointed at the license mgr if it's not indexing? Looking at this: https://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/TypesofSplunklicenses - it seems to indicate that isn't necessary. How would I "manually converted to the Forwarder license group" ?

0 Karma

sloshburch
Ultra Champion

What about a correlation of slaves from the REST endpoint that also show up in the license_usage.log during that time period. Wouldn't that show just splunk installs doing indexing?

0 Karma

somesoni2
Revered Legend

You can enable the forwarder license on your Heavy forwarders by running following commands. Once they are converted to Forwarder License, they'll no longer be slave to License master and your rest api query would return only indexers.

$SPLUNK_HOME/bin/splunk edit licenser-groups Forwarder -is_active 1
$SPLUNK_HOME/bin/splunk restart
0 Karma

a212830
Champion

Tried that and received this:

[splunk@vlmmk301 bin]$ ./splunk edit licenser-groups Forwarder -is_active 1
Your session is invalid. Please login.
Splunk username: admin
Password:

In handler 'groups': no stacks/licenses corresponding to group=Forwarder

0 Karma

somesoni2
Revered Legend

What version of Splunk are you using on your Heavy Forwarders?

Also, try adding this to server.conf on your heavy forwarder ($SPLUNK_HOME/etc/system/local/server.conf)

[license]
active_group =  Forwarder 

Restart Splunk afterwards.

0 Karma

sloshburch
Ultra Champion

If you use ./splunk list licenses you can see what's you've got to play with. Use ./splunk help list to see the list of options.

$ /opt/splunk_dev/bin/splunk edit licenser-groups Forwarder -is_active 1
The licenser-groups object has been edited.

That only worked on an instance where I had a Forwarder license stanza in my local/server.conf.

0 Karma

lycollicott
Motivator
0 Karma

a212830
Champion

I did | rest count=0 /services/licenser/slaves - same thing, no?

0 Karma

lycollicott
Motivator

Yes, that will do the same thing.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!