How can I identify an indexer using my license master?

[twinspop]

A rogue splunk installation within our corp network is using our license master. Unfortunately, there is no information that I see in the LM interface nor logs that can tell me the IP or hostname of the server. I can only get the GUID and the splunk instance name.

Is there a way to get the IP of a connecting license slave?

[somesoni2]

You can run this query on the License Master servers to find host name/IP of the Indexer (license slaves) connecting to your License master.

| rest /services/licenser/slaves splunk_server=local | table title label | rename title as GUID label as Indexer

[twinspop]

This only displays the instance name of the connecting server. Not the hostname nor IP.

[somesoni2]

How about this

index=_internal component=Metrics group=tcpin_connections [| rest /services/licenser/slaves splunk_server=local | table title | rename title as guid ] | dedup sourceHost sourceIp | table sourceHost sourceIp hostname guid version os

[twinspop]

Nice output, but unfortunately it relies on seeing _internal logs for the rogue indexer.

[yannK · Accepted solution]

when they connect, they will report an event in the _internal index under splunkd_access.log on the license master, and the ip of the sender should be listed.
So you could check for the connections attempts, or whitelist for a short time, then check the logs.

[twinspop]

Brute force method, but it worked. I tied in license usage logs, used transaction to group by the second, and then looked for the most common IPs.

index=_internal sourcetype=splunkd_access OR (source=*license_usage.log pool=denied) | transaction maxspan=1s | search denied post | rex "[[ipv4]]"

[micahkemp]

On the License Master, there is a report you can view to see the license usage split by various methods. For "by indexer", look at:

Settings -> Licensing -> Usage Report -> Previous 30 Days -> Split By (select Indexer)

Edit: I see now you need to find the IP address, and not just the identifying information the indexer makes available. You may try looking at active TCP sessions to your License Master on port 8089. If you're on Linux you could run netstat -aln | grep 8089 (replace netstat with ss for some newer distributions of Linux).

[twinspop]

Yeah, tried the netstat method. With about 80 different slaves phoning home to the LM, it's not really possible to see which is which. Or at least, I'm not aware of a good way to filter through them.