Installation

How can I migrate a Splunk License Master to a brand new server without service interruption?

dshakespeare_sp
Splunk Employee
Splunk Employee

I need to migrate my old standalone Splunk License Master to a new server as my old License Master is being decommissioned. I need to do this without interruption to service.

My License Slaves are configured to point to a License Master FQDN. The plan is to change the DNS record of the License Master to a new IP address. What is the best way of achieving this?

Labels (1)

dshakespeare_sp
Splunk Employee
Splunk Employee

A suggestion would be

  1. "splunk stop" on old License Master
  2. "splunk stop" on new License Master
  3. copy over the relevant licenses from the old License Master to the new License Master
  4. copy over etc/system/local/server.conf (which contains the pool configuration) and etc/instance.cfg from old License Master to new License Master This should ensure that the new LM conserves the same GUID
  5. Change DNS to reflect new IP Address
  6. Wait a few minutes and test low level connectivity from License Slaves to new License Master (ping / dig / arp -a)
  7. "splunk start" on new LM

  8. As a safety precaution rename /etc/instance.cfg to /etc/instance.cfg.old to ensure that if the old License Master is restarted the GUID does not clash with the new License Master

  9. Test

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...