Is there a possibility to implement a high-availability concept in Splunk License master server?
Scenario: when the Splunk license master server goes DOWN/UNREACHABLE, Splunk indexers & forwarders connected to the master servers are orphaned (if >24hrs down), where if the secondary license master is there, which can supplement this.
No violation in license usage. Usage calculation per daily basis should be based on primary.
About the connection between the license master and license slaves When you configure a license master instance and add license slaves to it, the license slaves communicate their usage to the license master every minute. If the license master is down or unreachable for any reason, the license slave starts a 72 hour timer. If the license slave cannot reach the license master for 72 hours, search is blocked on the license slave (although indexing continues). Users will not be able to search data in the indexes on the license slave until that slave can reach the license master again.