- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i have setup on prem new SH cluster and Deployment server with Splunk enterprise version 8.2.5.
I have configure new 3 SH as slave and pointed to License Master but Salve not syncing with License Master.
Note: We have three license pool in License master and I have update pool stanza in server.conf as well but no luck. Please suggest.
I have performed below config steps on server.conf on 3 SH and Deployment Host Separately.
- Select a new passcode to fill in for pass4SymmKey.
- SSH to the Splunk instance.
- Edit the /opt/splunk/etc/system/local/server.conf file.
- Under the [general] stanza pass4SymmKey field, replace the hashed value with the new passcode in plain text. It will stay in plain text until Splunk services are restarted.
- Save the changes to the server.conf file.
- Restart Splunk services on that node.
Here is the server.conf on SH as License Slave.
-----------------------------------------------------------------------------------------------------------------------------------------------
[general]
serverName = SHHost123
pass4SymmKey = Same is License Master
[license]
master_uri = https://x.x.x.x:8089
active_group = Enterprise
[sslConfig]
sslPassword = 12344…
[lmpool:auto_generated_pool_download-trial]
description = auto_generated_pool_download-trial
quota = MAX
slaves = *
stack_id = download-trial
[lmpool:auto_generated_pool_forwarder]
description = auto_generated_pool_forwarder
quota = MAX
slaves = *
stack_id = forwarder
[lmpool:auto_generated_pool_free]
description = auto_generated_pool_free
quota = MAX
slaves = *
stack_id = free
[lmpool:auto_generated_pool_enterprise]
description = auto_generated_pool_enterprise1
quota = MAX
slaves = *
stack_id = enterprise
[replication_port://9023]
[shclustering]
conf_deploy_fetch_url = http://x.x.x.x:8089
disabled = 0
mgmt_uri = https://x.x.x.x:8089
pass4SymmKey = 23467….
shcluster_label = shclusterHost_1
id = D6E63C0A-234S-4F45-A995-FDDE1H71B622
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here i mentioned 3SH and 1 Search Head Deployer in Cluster Environment. I have not yet connect SH to any indexer. I just wanted to connect all 3 SH and SH deployer to move from trial version to license version.
After Connecting all hosts to license mater, i will connect 3SH to Indexer Master.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Issue has been with Passkey and i got license master passkey using below command by decrypting license master pass4SymmKey putting plain text password in general stanza.
[splunk@cis-splunkmgmt bin]$ ./splunk show-decrypted --value 'License pass4SymmKey hash'.
Its Resolved now
'
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have plan to attached SH cluster to existing indexer cluster.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @hemantw7,
as I said, it's a best practice to configure all Splunk servers (except Indexers) to forwarder their logs to the Indexers.
In this way you can configure for them the Forwarder license and you don't need to connect them to the License Master.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Its SH cluster i am trying to configure as License slave with existing License master.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @hemantw7,
ok but you you can do also the contrary procedure: before forwarding, then license onfiguring.
don't need to maybe it's only a representation, but I suppose that you configured all your search Head in Indexers discovery (https://docs.splunk.com/Documentation/Splunk/9.0.3/Indexer/indexerdiscovery) and not only one directly connected to Indexers.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here i mentioned 3SH and 1 Search Head Deployer in Cluster Environment. I have not yet connect SH to any indexer. I just wanted to connect all 3 SH and SH deployer to move from trial version to license version.
After Connecting all hosts to license mater, i will connect 3SH to Indexer Master.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @hemantw7,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @hemantw7,
some details please:
when you speak of Deployment Server, are you speaking of the Deployer, is it correct?
because you cannot use the Deployment Server to manage Search Heads.
Why do you speak of License Master, Search Heads and all the servers except Indexers are usually configured as forwarders so they don't need to be connected with the License Master.
Ciao.
Giuseppe
