I have a splunk clustered environment, where the License Manager has a none existent(cannot be resolved/name-lookup) servername configured (etc/system/local/server.conf -> serverName). This has been running like this for a some time. But this is introducing issues with license monitoring in Montioring Console. To eliminate this issue and make this Splunk instance to comply to other existing instances, i tried to simply change the serverName in server.conf to the hostname and restarting the Splunk service. Splunk service is starting without complains, but the Monitoring Console reports that suddenly all the SearchHeads are unreachable. Querying the Searchheads for shcluster-status, results in errors. Reverting back to the old name and restarting, fixes that SearchHead unreachable issue and status. This License Manager server has following roles: * License manager * (Monitoring Console) * Manager Node I do not see any connection on why this change is affecting Searchheads. Indexers are fine. Deployer is a different server. I found documented issues (for this kind of change) for Indexers and the Monitoring Console itself or that it can have side affects for the Deployment Server, but no real hit on Searchheads/SHC. As i do not have permanent access to this instance. I have to prepare kind of a remediation plan or at least analysis. I'm searching for hints where I can start with my investigation. Maybe someone had successfully changed a License Master name. Hoping that I'm missing something obvious. Thanks
... View more