What are the best approaches for high availability of the license master?
If the license master server goes down, do we simply change one of the slaves to become a local master, and then changing it to become a license master and re-setting up the license slaves?
To avoid setting up all the license slaves again, should we set up a cname for the license master and if that server fails, we change one of the slaves to become a master and point the cname to that server?
Any help and links to documentation is greatly appreciated.
if you still need an answer on this topic, here is one 🙂
in older Splunk releases it used to be 24 hours before you get into trouble if your license master is gone.
Now with Splunk 6.1.3, if the license master is down or unreachable for any reason, the license slave starts a 72 hour timer. If the license slave cannot reach the license master for 72 hours, search is blocked on the license slave (although indexing continues).