Installation

Moving the license key from one license master to another -- Are there any potential issues?

landen99
Motivator

Within the same environment, the license key is to be moved from one license master to another of the same Splunk version.

If the license is removed from the old license master, the indexers are pointed to the new license master and restarted, and the license is added to the new license master, are there any potential issues?

Note: Nothing is changing about the rest of the Splunk configurations or network configurations. Everything happens within the same network and there are no firewall issues or anything else to worry about except the license move. Assuming the only changes are with moving an Enterprise license key to a new license server.

Labels (1)
0 Karma
1 Solution

saurabh_tek11
Communicator

Hi @landen99, Moving the license master is simple and as far as your situation is concerned there should not be any potential issue IMO. Also in the worst case, you will have 72 hours from the License Master going down till the operations actually gets a hit (when Search becomes unavailable). Your indexing will still work, you just wont be able search the data if LM is down for more than 72 hours.
Splunk docs link for this is here

I see your question was posted in october. I assume by now, if management approved you must have already done the task. Did you faced any challenge ? What version of splunk are you using on old and new LM ?

*To get this done is easy as 1-2-3.
If you have distributed management of Licensing *

  1. Just add the license key on new LM. Replicate the pools are in old LM.
  2. Point all your license slave instances to new LM and verify the connection at both ends for each slave one-by-one Settings > Licensing » Change master association > Designate a different Splunk instance as the master license server
  3. When all slaves are connected to new LM, remove license from old LM to de-activate it

More information at splunk doc here

If you have central management of licensing
You can update/push this configuration centrally from DS, by creating an app as
\opt\splunk\etc\my_overall_license_master\local\server.conf

[license]
# Example: master_uri = https://10.1.1.5:8089
master_uri = https://IP.of.license.master:mgmt_port

And reload/push this app from DS to all splunk instances.

Unfortunately, if your existing indexers have their license::master_uri setting in their $SPLUNK_HOME/etc/system/local/server.conf, the DS app won't work, as system/local is an override. You'll have to remove these entries manually, to allow the DS app's setting to show through.

If this answers your question, please accept it or feel free to ask and clear your doubt, if any.

View solution in original post

a583664manju
New Member

Splunk recommended for service restart on Slave after changing License Manager server in the document https://docs.splunk.com/Documentation/Splunk/8.0.2/Admin/Swapthelicensemaster 

But we have come across different options to perform the same:

  • Update of the new LM details done from GUI --> Here restart of the service wasn’t needed, it was showing up in License Manager
  • Update of the new LM details done from CLI
    • Service was not restarted à Here most of the indexers were showing in License Manager
    • Service was restarted à Some of the indexers were required restart as it wasn’t showing in License Manager
0 Karma

saurabh_tek11
Communicator

Hi @landen99, Moving the license master is simple and as far as your situation is concerned there should not be any potential issue IMO. Also in the worst case, you will have 72 hours from the License Master going down till the operations actually gets a hit (when Search becomes unavailable). Your indexing will still work, you just wont be able search the data if LM is down for more than 72 hours.
Splunk docs link for this is here

I see your question was posted in october. I assume by now, if management approved you must have already done the task. Did you faced any challenge ? What version of splunk are you using on old and new LM ?

*To get this done is easy as 1-2-3.
If you have distributed management of Licensing *

  1. Just add the license key on new LM. Replicate the pools are in old LM.
  2. Point all your license slave instances to new LM and verify the connection at both ends for each slave one-by-one Settings > Licensing » Change master association > Designate a different Splunk instance as the master license server
  3. When all slaves are connected to new LM, remove license from old LM to de-activate it

More information at splunk doc here

If you have central management of licensing
You can update/push this configuration centrally from DS, by creating an app as
\opt\splunk\etc\my_overall_license_master\local\server.conf

[license]
# Example: master_uri = https://10.1.1.5:8089
master_uri = https://IP.of.license.master:mgmt_port

And reload/push this app from DS to all splunk instances.

Unfortunately, if your existing indexers have their license::master_uri setting in their $SPLUNK_HOME/etc/system/local/server.conf, the DS app won't work, as system/local is an override. You'll have to remove these entries manually, to allow the DS app's setting to show through.

If this answers your question, please accept it or feel free to ask and clear your doubt, if any.

saurabh_tek11
Communicator

@landen99, does this helps.

0 Karma

jkamdar
Engager

@saurabh_tek11 thanks for these easy steps. I have a question about "Just add the license key on new LM". Do I just copy files from my current master /opt/splunk/etc/licenses/enterprise to the new Splunk server that I want to promote as a master. I have 34 files in that directory.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...