I have two search heads that have enterprise license expired, and I need to associate them to a master license server.
However. There's no 'License' option under setting, which I could find in deployers and indexers.
Also. During login, I will be redirected to a page to prompt for 'change license group'. Rightfully, clicking cancel shall redirect me to a page to associate to master license server. Instead, I am getting error 404.
Checking the log and here's what I found:
capabilities:21 - Access denied for path "/en-US/manager/system/licensing". Returning 404. Insufficient user permissions
May I know what's wrong with my search heads?
Thanks in advance
its a little unclear to me from your question if you are asking regarding only 2 search heads out of the Search Head Cluster or regarding separate Search Heads (since you said: "I have two search heads ...)
first make sure that the Search Heads are not license Slaves already by checking your License Master.
Now, try to create a small deployment app on your Deployer, call it somethingalllicense_slaves or another name
create a server.conf file under the local directory in your app. file will have the following in it:
[license] master_uri = https://IP.of.license.master:mgmt_port # example: master_uri = https://18.104.22.168:8089
place the app in $SPLUNK_HOME/etc/shcluster/apps
deploy the app to the Search Head Cluster Members.
check your License Master.
hope it helps
Hi Adonio, I'm away with limited Internet access currently. Will try it next week. Meanwhile thanks for your help!