Installation

pass4SymmKey didn't help with "Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=XX.XX.XX.XX"

yaraslau_haradz
New Member

I have Sarchhead and 4 indexers connected to it. (Indexer_lic, Indexer1, Indexer2, Indexer3).
Indexer_lic operates as License Master.
I migrated Indexer_lic from one machine to another.
Searchhead, Indexer1 and Indexer2 were connected to License Maser as Slaves successfully

When I'm trying to connect slave Indexer3(IP 172.18.32.156) to License master I get next error:
"Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=172.18.32.156'"

I replaced next string in file splunk/etc/system/local/server.conf with next value and restarted Licnese Master:
"[general]
pass4SymmKey = changeme"

Then I did the same for Indexer3.

After restarting error while setting License Master URI still present:
"Bad Request — In handler 'localslave': editTracker failed, reason='WARN: path=/masterlm/usage: invalid signature on request from ip=172.18.32.156'"

Indexer3 is located in another network and I use NAT (network address translation) to connect to License master.
I checked connection to License master using Linux command line at Indexer3. Port is opened, connection is available.
"telnet 194.39.131.7 8089
Trying 194.39.131.7...
Connected to 194.39.131.7.
Escape character is '^]'.
^]
telnet> sfd
?Invalid command
telnet> ^C"

Could you please help me to connect my Indexer3 server to License Master.
Issue is urgent because I'll get License violation and search will stop to work for all cluster.

Labels (2)
0 Karma
1 Solution

masonmorales
Influencer

Check your case and syntax again on Indexer3 and restart it. What you posted looks fine and the error is pretty explicit. Updating the pass4SymmKey to match the license master's and then restarting Splunk has always worked for me in resolving this error. If you can't get it, open a Splunk Support case.

View solution in original post

0 Karma

masonmorales
Influencer

Check your case and syntax again on Indexer3 and restart it. What you posted looks fine and the error is pretty explicit. Updating the pass4SymmKey to match the license master's and then restarting Splunk has always worked for me in resolving this error. If you can't get it, open a Splunk Support case.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...