License slave indexing data but showing "0%" license used on license master.

[mgiddens]

Hello,

I have a license slave that is an indexer. (actually 2, these indexers are clustered)
One indexer is currently indexing data just fine but shows "0%" on the license master under the Licensing section in the configured license pool.
The other indexer in the pool (the other index cluster member) is just fine; reporting accurate percentage used.

I looked in the license_usage.log on the license manager but I do not see the indexer in question anywhere in the logs; I do see the other indexer in the pool showing a percentage used on the license manager.

On the indexer in question, under licensing, all settings are correct to slave it to the license master, and if I refresh, It will show the last communicated time increase up until it hits a minute then starts over,,, so I know its checking in with license manager every minute as it should.

Any reason why the indexer / license slave is not showing percentage of license used?

Thanks,
mgiddens

[mgiddens · Accepted solution]

Never posted the answer here. This issue was due to the fact I wasnt't forwarding my license master's internal logs to my index cluster.

• I configured "outputs.conf" file in "/opt/splunk/etc/system/local/outputs.conf" to forward from license master to index cluster.
• License usage started to reset at midnight again.

Thanks for all the advice and hope someone would find this useful someday.

mgiddens

[koshyk]

What's your settings in your license slave & license master? Any errors shown in your other indexer

License Master server.conf should contain

[license]
active_group = Enterprise

All other systems server.conf should contain

[license]
master_uri = {{license_master_uri}}

[mgiddens]

Thank you for your response koshyk.

License master and slaves have the stanzas set as you mentioned in your post.
I also did a side by side comparison on server.conf between the one working and the one not working; they are the same.

I did a splunk server restart; no change.

I looked at the server in questions license_usage log; it does indicate as of today even to view license usage, check the license_usage.log on the license master (then it list the correct license master a the end of the log entry).

So it seems the indexer is pushing the info to the license master and not recording it locally; but the percentage used showing in the license pool shows 0% for that server.

[koshyk]

please also check if there is any difference in server.conf using btool between two servers

[mgiddens]

Is this because I have my indexers clustered?
I should still show a percentage used for each of my indexers in my index cluster on the license master UI if the forwarders are load balancing their forwarding to each indexer right? (and again I have confirmed the splunk instances are load balancing between the two indexes when they send their internal logs over to the indexers).

Thanks again.

mgiddens