Monitoring Splunk

License slave indexing data but showing "0%" license used on license master.

mgiddens
Path Finder

Hello,

I have a license slave that is an indexer. (actually 2, these indexers are clustered)
One indexer is currently indexing data just fine but shows "0%" on the license master under the Licensing section in the configured license pool.
The other indexer in the pool (the other index cluster member) is just fine; reporting accurate percentage used.

I looked in the license_usage.log on the license manager but I do not see the indexer in question anywhere in the logs; I do see the other indexer in the pool showing a percentage used on the license manager.

On the indexer in question, under licensing, all settings are correct to slave it to the license master, and if I refresh, It will show the last communicated time increase up until it hits a minute then starts over,,, so I know its checking in with license manager every minute as it should.

Any reason why the indexer / license slave is not showing percentage of license used?

Thanks,
mgiddens

Tags (1)
0 Karma
1 Solution

mgiddens
Path Finder

Never posted the answer here. This issue was due to the fact I wasnt't forwarding my license master's internal logs to my index cluster.

  • I configured "outputs.conf" file in "/opt/splunk/etc/system/local/outputs.conf" to forward from license master to index cluster.
  • License usage started to reset at midnight again.

Thanks for all the advice and hope someone would find this useful someday.

mgiddens

View solution in original post

0 Karma

mgiddens
Path Finder

Never posted the answer here. This issue was due to the fact I wasnt't forwarding my license master's internal logs to my index cluster.

  • I configured "outputs.conf" file in "/opt/splunk/etc/system/local/outputs.conf" to forward from license master to index cluster.
  • License usage started to reset at midnight again.

Thanks for all the advice and hope someone would find this useful someday.

mgiddens

0 Karma

koshyk
Super Champion

What's your settings in your license slave & license master? Any errors shown in your other indexer

License Master server.conf should contain

[license]
active_group = Enterprise

All other systems server.conf should contain

[license]
master_uri = {{license_master_uri}}
0 Karma

mgiddens
Path Finder

Thank you for your response koshyk.

License master and slaves have the stanzas set as you mentioned in your post.
I also did a side by side comparison on server.conf between the one working and the one not working; they are the same.

I did a splunk server restart; no change.

I looked at the server in questions license_usage log; it does indicate as of today even to view license usage, check the license_usage.log on the license master (then it list the correct license master a the end of the log entry).

So it seems the indexer is pushing the info to the license master and not recording it locally; but the percentage used showing in the license pool shows 0% for that server.

0 Karma

koshyk
Super Champion

please also check if there is any difference in server.conf using btool between two servers

0 Karma

mgiddens
Path Finder

Is this because I have my indexers clustered?
I should still show a percentage used for each of my indexers in my index cluster on the license master UI if the forwarders are load balancing their forwarding to each indexer right? (and again I have confirmed the splunk instances are load balancing between the two indexes when they send their internal logs over to the indexers).

Thanks again.

mgiddens

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>