Thanks for the response! I'm not sure I'm following the your train of thought. The real problem was that this single new Indexer didn't have the right pass4SymmKey, and the only way to get it the right now, was to paste the plain text in it, and restart Splunk. However, restarting it in the 7.2.1 environment produces an encrypted passkey that is much longer, and incorrect than the right one, so downgrading to 6.6 on just this single Indexer, and then changing the pass4SymmKey, restarting splunk, letting it encrypt, then upgrade back to 7.2.1, was my fix. It took about 30 minutes, but it didn't take the Search Head down during the change, so that was a plus.
The more I chew on your answer, are you saying that by deleting the license file on the LM, and re-uploading it, that the Indexer would somehow right itself and check-in?
Again, thanks for your input! I Always appreciate other's theories and ideas!
... View more