Splunk license reverts to free version after upgrading to 4.2.1

[jambajuice]

Whenever we upgrade a 4.1 server to 4.2.1, Splunk reverts to the enterprise trial license. When I look in the etc directory, I no longer see a splunk.license file. Even after I have added the license to Splunk via the GUI.

We're going to need to upgrade Splunk to 4.2 on over three hundred servers. How can I automate applying the license to those servers after they are upgraded to 4.2.1?

And really, guys... Shouldn't the license survive the upgrade procedure?

Thx.

[gkanapathy]

Separate forwarder licenses are not required in 4.2. Instead, forwarder licensing is enabled via a server.conf configuration:

[license]
active_group = Forwarder

Maybe it would make sense to have this setting built in to the SplunkLightForwarder and SplunkForwarder apps.

Note that 4.2 enterprise licenses are stored in etc/licenses/stackname/*, and during migration the old etc/splunk.license file is moved there to a stack named enterprise (if it is an eligible enterprise license) and the local server is automatically added to a pool that consumes that license, so it should work exactly the same after upgrade. The old file location of course is no longer valid. You may wish to consolidate all enterprise licenses to a single stack on a master instance, and point all other indexers as slaves to that master.

[hazekamp]

Jamba,

For light forwarders you will want to make sure that the following stanza is enabled in server.conf:

## server.conf
[license]
active_group = Forwarder

If you are pushing out via deployment-server or enabling 4.2.x SplunkLightForwarder apps this setting will be enabled automatically. For full forwarders that are indexing the instance should instead be given access to an Enterprise license stack. Universal forwarders apply the forwarding license automatically.

See also: Types of Splunk licenses

[jambajuice]

It looks like this is only happening about 50% of the time. It doesn't seem to matter whether the machine is Windows 2003 or 2008