distributed search issue - duplicate licenses

[castle1126]

Hi all,

My old, primary Splunk indexer/search head is being retired (v4.1.4). In its place is 4 new indexing servers that are carrying the indexing load for me (all running v4.1.5). Each of these 4 systems were built from scratch, with indexes.conf being moved to them.

I'm trying to set this old server to be a search head for the new systems, allowing it to run some scheduled searches this weekend before we retire the server. When I add the search peers to the old system via the GUI, they all go in nicely without complaint. When I log back into the old server's GUI again I get this message on the top of my browser:

Unable to distribute to peer named xxx at uri https://xxxx:8089 because peer has status = "Duplicate License".

When I look at Manager->Distributed search-> Search Peers I see the 4 peers showing a status of "duplicate license".

I've dug around through logs on all systems and nothing pops out as being in error, etc.

Any ideas?

[ftk · Accepted solution]

Sounds like you still have your old license installed on your old indexer/new search head, and you used the same license at one (or all?) of the new indexers.

At the search head you want to change the license to the Forwarder license (as long as it doesn't do any indexing) and your troubles will go away.

[castle1126]

That was it! I thought I had changed licenses prior to setting up distributed searches but didn't. Thanks!