Installation

Is there a way to access license REST calls from non-license manager?

a212830
Champion

Hi,

I want to make some license info available on my customer Search Head (SH), and the easiest way appears to be the license REST calls. Unfortunately, when I run the commands as admin on the SH, it returns zero results. Is there anyway to call these from a non-license manager search head?

| rest splunk_server=local /services/licenser/pools | rename title AS Pool | search [rest splunk_server=local /services/licenser/groups | search is_active=1 | eval stack_id=stack_ids | fields stack_id] | eval quota=if(isnull(effective_quota),quota,effective_quota) | eval "% used"=round(used_bytes/quota*100,2) |eval Pool=if(Pool="auto_generated_pool_enterprise","EI License",Pool), Pool=if(Pool="ECS Licensing", "ECS License",Pool) | fields Pool "% used"
Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Only way to be able to run licenser REST api from a non-license master node is to add licence master node as distributed search peer to the search head. Here are the instructions for that: https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Configuredistributedsearch

Please note that with this method, you would need to remove splunk_server=local portion of your search as the rest api endpoint is not local. You can either just ignore that option altogether, or user splunk_server="name of your license master".

View solution in original post

somesoni2
Revered Legend

Only way to be able to run licenser REST api from a non-license master node is to add licence master node as distributed search peer to the search head. Here are the instructions for that: https://docs.splunk.com/Documentation/Splunk/6.5.2/DistSearch/Configuredistributedsearch

Please note that with this method, you would need to remove splunk_server=local portion of your search as the rest api endpoint is not local. You can either just ignore that option altogether, or user splunk_server="name of your license master".

a212830
Champion

Thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...