Is ITSI license limited on the number of SH's it will authorize?

[csprice]

We have an ITSI instance with a 4 member SHC and a 4 member indexer cluster.

Every day one of the SHC members complains that it doesn't have a valid ITSI license. Restarting splunk seems to cause this error to go away but move to a different SHC member.

Looking in the itsi_license_checker.log across all 4 instances, you can see the error travel between the server with one and only one instance complaining that the "Splunk instance does not have a valid license for IT Service Intelligence."

Checking the license master - both the Splunk Enterprise and Splunk ITSI Perpetual licenses show up and have an expiration of more than 20 years from now.

Any thoughts on why this is happening?

[mdonnelly_splun]

I realize this is an old request but people keep seeking information related to the title of this post ...

ITSI is only licensed by data volumes from the indexers.

None of the following are controlled by the ITSI license:

Search heads

Indexers, indexer clusters

users

KPIs, glass tables, services, entities

As to the cause of the problem in your post...

* Verify that each search head is configured for the license master
* Verify KV Store replication status

[skoelpin]

You shouldn't be getting a license error on a SH member since the data lives on the indexers. Is your SH members connected to the license master? Are they acting as a license master?

[csprice]

They are connected to the license master.

[csprice]

Also, it's not a license violation - it's an invalid license warning on just one instance that hops from shc member to shc member.