Installation

How can I identify an indexer using my license master?

twinspop
Influencer

A rogue splunk installation within our corp network is using our license master. Unfortunately, there is no information that I see in the LM interface nor logs that can tell me the IP or hostname of the server. I can only get the GUID and the splunk instance name.

Is there a way to get the IP of a connecting license slave?

alt text

Labels (2)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

when they connect, they will report an event in the _internal index under splunkd_access.log on the license master, and the ip of the sender should be listed.
So you could check for the connections attempts, or whitelist for a short time, then check the logs.

View solution in original post

somesoni2
Revered Legend

You can run this query on the License Master servers to find host name/IP of the Indexer (license slaves) connecting to your License master.

| rest /services/licenser/slaves splunk_server=local | table title label | rename title as GUID label as Indexer
0 Karma

twinspop
Influencer

This only displays the instance name of the connecting server. Not the hostname nor IP.

0 Karma

somesoni2
Revered Legend

How about this

index=_internal component=Metrics group=tcpin_connections [| rest /services/licenser/slaves splunk_server=local | table title | rename title as guid ] | dedup sourceHost sourceIp | table sourceHost sourceIp hostname guid version os
0 Karma

twinspop
Influencer

Nice output, but unfortunately it relies on seeing _internal logs for the rogue indexer.

0 Karma

yannK
Splunk Employee
Splunk Employee

when they connect, they will report an event in the _internal index under splunkd_access.log on the license master, and the ip of the sender should be listed.
So you could check for the connections attempts, or whitelist for a short time, then check the logs.

View solution in original post

twinspop
Influencer

Brute force method, but it worked. I tied in license usage logs, used transaction to group by the second, and then looked for the most common IPs.

index=_internal sourcetype=splunkd_access OR (source=*license_usage.log pool=denied) | transaction maxspan=1s | search denied post | rex "[[ipv4]]"

0 Karma

micahkemp
Champion

On the License Master, there is a report you can view to see the license usage split by various methods. For "by indexer", look at:

Settings -> Licensing -> Usage Report -> Previous 30 Days -> Split By (select Indexer)

Edit: I see now you need to find the IP address, and not just the identifying information the indexer makes available. You may try looking at active TCP sessions to your License Master on port 8089. If you're on Linux you could run netstat -aln | grep 8089 (replace netstat with ss for some newer distributions of Linux).

0 Karma

twinspop
Influencer

Yeah, tried the netstat method. With about 80 different slaves phoning home to the LM, it's not really possible to see which is which. Or at least, I'm not aware of a good way to filter through them.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!