Since upgrading to 4.3, all of the license slaves I have show login screens with the "Upgrade to Splunk Enterprise to add alerting, single sign-on blah blah..."
Previously they acknowledged their licensing as dictated by the master. The LM server shows them as slaves and properly licensed.
Today, they all suspended searching for license violations but volume is well below our licensed level. These 2 seem related.
I've heard nothing, but continue to see the (harmless) behavior on the login screen with at least 4.3.1 systems. I've heard nothing from Splunk regarding the issue.
The issue with license violations was not related, and Splunk support helped me track it down.