Installation

Splunk license reverts to free version after upgrading to 4.2.1

jambajuice
Communicator

Whenever we upgrade a 4.1 server to 4.2.1, Splunk reverts to the enterprise trial license. When I look in the etc directory, I no longer see a splunk.license file. Even after I have added the license to Splunk via the GUI.

We're going to need to upgrade Splunk to 4.2 on over three hundred servers. How can I automate applying the license to those servers after they are upgraded to 4.2.1?

And really, guys... Shouldn't the license survive the upgrade procedure?

Thx.

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Separate forwarder licenses are not required in 4.2. Instead, forwarder licensing is enabled via a server.conf configuration:

[license]
active_group = Forwarder

Maybe it would make sense to have this setting built in to the SplunkLightForwarder and SplunkForwarder apps.

Note that 4.2 enterprise licenses are stored in etc/licenses/stackname/*, and during migration the old etc/splunk.license file is moved there to a stack named enterprise (if it is an eligible enterprise license) and the local server is automatically added to a pool that consumes that license, so it should work exactly the same after upgrade. The old file location of course is no longer valid. You may wish to consolidate all enterprise licenses to a single stack on a master instance, and point all other indexers as slaves to that master.

0 Karma

hazekamp
Builder

Jamba,

For light forwarders you will want to make sure that the following stanza is enabled in server.conf:

## server.conf
[license]
active_group = Forwarder

If you are pushing out via deployment-server or enabling 4.2.x SplunkLightForwarder apps this setting will be enabled automatically. For full forwarders that are indexing the instance should instead be given access to an Enterprise license stack. Universal forwarders apply the forwarding license automatically.

See also: Types of Splunk licenses

0 Karma

jambajuice
Communicator

It looks like this is only happening about 50% of the time. It doesn't seem to matter whether the machine is Windows 2003 or 2008

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...