SPLUNK License master down - what is the impact ??

[rakesh_498115]

Hi ,

I have a single license master with 4 indexer servers sharing the license from it. From this morning, my License Master was down, but I can still see Splunk indexing is working and there was no impact to the data.

I was surprised that Splunk can still index all the data to the indexers even though the Master license server is down. If this is the case, then what is the impact? Is there an idle time that Splunk stops indexing data until the master is up and running again?

Do we need to change the Master since the existing server is down? Can someone help me here pls?

thanks,
Rakesh.

[surajkuvar]

@esix[Splunk] What happens when License master is down. Does it count for indexing when it was down?

[esix_splunk · Accepted solution]

You will have 72 hours from the License Master going down till when Search becomes unavailable. Your indexing will still work, you just wont be able search the data.

Read this : http://docs.splunk.com/Documentation/Splunk/6.4.0/Admin/Aboutlicenseviolations

So you need to restore / rebuild the license master as soon as possible.