ITSI license issue using License manager

[vtamas]

We have a lab Splunk deployment with the following specification:

• 3 indexers in an indexer cluster
• 1 SH for normal searches
• 1 SH with ITSI installed
• 1 SH with Enterprise Security installed
• 1 server that acts as the Cluster manager for the indexers and as the License manager

We have NFR licenses (Enterprise, ITSI) installed on the License manager and all the other servers are configured as license peers.

With the above setup the problem is that the ITSI license doesn't work, and we only get IT Essential Works. When the ITSI license is installed directly on the ITSI server ITSI is working correctly (but the other licences don't apply in this case, because those are installed on the License manager).

We installed the required applications (SA-ITSI-Licensechecker and SA-UserAccess) on the License manager as per the official documentation. 

Did anyone encounter similar problem and if so, what was the solution?

[livehybrid]

Hi @vtamas 

Just to check, how many licenses do you have listed in the license page on your License Manager? 

As far I know you should have 3, the Core/Enterprise license, the ITSI entitlement license and the ITSI "Internal" license (not to be confused with the other ITSI license - this allows for ITSI sourcetypes to be ingested without impacting your main core license).

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[vtamas]

Hi @livehybrid 

We don't have the ITSI "internal" license listed.

Also, we use NFR (Not For Resale) licences.

[skramp]

Hi,

Splunk and ITSI licenses must be the same type, like prod, dev or test. So I assume while both are NFR they are the same type. You have installed the "ITSI license checker" out of the itsi-package on your license server?