Installation

pass4SymmKey error when setting Master License

guimilare
Communicator

Hello Splunkers.

I have an Indexer Clusters with 2 members (IDX1 and IDX2).
We need to add another 2 indexers to the cluster.
The Indexer Cluster is in version 6.5.0.
The are 2 other machines (they will be IDX3 and IDX4) running the same splunk version, but their Trial License expired a long time ago and were never added to Indexer Cluster or set as Slave License servers.

I've changed the license on IDX3 and IDX4 to Free License and restarted splunkd.
But when trying to configure IDX3 and IDX4 to be slaves of a Master License, I get the following message:

Bad Request - editTracker failed, reason=WARN: path=/masterlm/usage: Signature mismatch between license slave=XX.XXX.XXX.XXX and this License Master. Please make sure that the pass4SymmKey setting in server.conf, under [general], is the same for the License Master and all its slaves from ip=XX.XXX.XXX.XXX

I've copied the pass4SymmKey from Master License to IDX3 and IDX4 but no luck.
Any ideas what I can do?
Or should I reinstall Splunk on these machines?

Regards,
GMA

0 Karma
1 Solution

masonmorales
Influencer

The pass4SymmKey is encrypted using splunk.secret, so you're likely copying an encrypted pass4SymmKey to hosts with different splunk.secret files.

Do you know what the plain text pass4SymmKey was set to on the License Master (LM)? If not, you can just set a new pass4SymmKey on the LM in plain text, restart it, (it'll encrypt automatically after restart), and use the same plain text pass4SymmKey/restart process on the other LM slaves.

View solution in original post

masonmorales
Influencer

The pass4SymmKey is encrypted using splunk.secret, so you're likely copying an encrypted pass4SymmKey to hosts with different splunk.secret files.

Do you know what the plain text pass4SymmKey was set to on the License Master (LM)? If not, you can just set a new pass4SymmKey on the LM in plain text, restart it, (it'll encrypt automatically after restart), and use the same plain text pass4SymmKey/restart process on the other LM slaves.

DUThibault
Contributor

YoungN
Splunk Employee
Splunk Employee

Can I clarify that you typed in the pass4SymmKey and not copied from the Master? As the Master will encrypt the password after initial setup and you would not be able to just copy it over.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...