Installation

pass4SymmKey didn't help with "Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=XX.XX.XX.XX"

yaraslau_haradz
New Member

I have Sarchhead and 4 indexers connected to it. (Indexer_lic, Indexer1, Indexer2, Indexer3).
Indexer_lic operates as License Master.
I migrated Indexer_lic from one machine to another.
Searchhead, Indexer1 and Indexer2 were connected to License Maser as Slaves successfully

When I'm trying to connect slave Indexer3(IP 172.18.32.156) to License master I get next error:
"Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=172.18.32.156'"

I replaced next string in file splunk/etc/system/local/server.conf with next value and restarted Licnese Master:
"[general]
pass4SymmKey = changeme"

Then I did the same for Indexer3.

After restarting error while setting License Master URI still present:
"Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=172.18.32.156'"

Indexer3 is located in another network and I use NAT (network address translation) to connect to License master.
I checked connection to License master using Linux command line at Indexer3. Port is opened, connection is available.
"telnet 194.39.131.7 8089
Trying 194.39.131.7...
Connected to 194.39.131.7.
Escape character is '^]'.
^]
telnet> sfd
?Invalid command
telnet> ^C"

Could you please help me to connect my Indexer3 server to License Master.
Issue is urgent because I'll get License violation and search will stop to work for all cluster.

Labels (2)
0 Karma
1 Solution

masonmorales
Influencer

Check your case and syntax again on Indexer3 and restart it. What you posted looks fine and the error is pretty explicit. Updating the pass4SymmKey to match the license master's and then restarting Splunk has always worked for me in resolving this error. If you can't get it, open a Splunk Support case.

View solution in original post

0 Karma

masonmorales
Influencer

Check your case and syntax again on Indexer3 and restart it. What you posted looks fine and the error is pretty explicit. Updating the pass4SymmKey to match the license master's and then restarting Splunk has always worked for me in resolving this error. If you can't get it, open a Splunk Support case.

0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...