Hi @landen99, Moving the license master is simple and as far as your situation is concerned there should not be any potential issue IMO. Also in the worst case, you will have 72 hours from the License Master going down till the operations actually gets a hit (when Search becomes unavailable). Your indexing will still work, you just wont be able search the data if LM is down for more than 72 hours.
Splunk docs link for this is here
I see your question was posted in october. I assume by now, if management approved you must have already done the task. Did you faced any challenge ? What version of splunk are you using on old and new LM ?
*To get this done is easy as 1-2-3.
If you have distributed management of Licensing *
Just add the license key on new LM.
Replicate the pools are in old LM.
Point all your license slave instances to new LM and verify the connection at both ends for each slave one-by-one
Settings > Licensing » Change master association > Designate a different Splunk instance as the master license server
When all slaves are connected to new LM, remove license from old LM to de-activate it
More information at splunk doc here
If you have central management of licensing
You can update/push this configuration centrally from DS, by creating an app as
\opt\splunk\etc\my_overall_license_master\local\server.conf
[license]
# Example: master_uri = https://10.1.1.5:8089
master_uri = https://IP.of.license.master:mgmt_port
And reload/push this app from DS to all splunk instances.
Unfortunately, if your existing indexers have their license::master_uri setting in their $SPLUNK_HOME/etc/system/local/server.conf, the DS app won't work, as system/local is an override. You'll have to remove these entries manually, to allow the DS app's setting to show through.
If this answers your question, please accept it or feel free to ask and clear your doubt, if any.
... View more