I have an Indexer/SearchHead/Deploy server sitting on one zone, and a Heavy Forwarder/Deploy server sitting on another zone. Currently my license installed on the Indexer. Since the Heavy Forwarder is a Deployment Server, i am unable to use a free or forwarder license. How would i set up licensing here? Would i configure the forwarder as a slave and point it to the Indexer?
I've tried this and I receive the following error:
Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: This license does not support being a remote master. from ip='
Does this mean i need a specific license that allows a slave connection?
Answering my own here. The answer is Yes. You set it up as a slave. My license was just an invalid one. After a proper license install, it seems to work fine now.
Hope this helps anyone else.
Do you know if a pure Heavy Forwarder with NO deployment function and NO local indexing require a license? Or is it taken just like a Universal Forwarder?
If there is no deploy server functionality, and no indexing then i believe no license required. it'll just act as a relay. You just need to set up forwarding to the main indexer. Standard port is 9997.
anyone know how this works with Splunk Cloud? or is it the same? Just point at Splunk Cloud as License Server?