Why am I unable to connect my indexers and search head to the license master with error "path=/masterlm/usage: invalid signature on request from ip=xxx.xxx.xxx.xxx"?

[thomas_forbes]

I cannot switch my Splunk Indexer group and Search head to communicate with my license master. Currently I have the Master node serving as my License Master. I was able to get my deployment server to identify and respond to the License master, but that is it.

Here is the error message I am receiving:

Failed to contact license master:  reason='WARN:  path=/masterlm/usage:  invalid signature on request from ip=xxx.xxx.xxx.xxx'.....

This message is just about completely meaningless to me.

Thank you for your input,

Tom Forbes

[thomas_forbes]

All of my pass4SymmKey settings are identical. I have no idea what is going on.

[thomas_forbes]

So what could the problem be if my Pass4SymmKeys all match the license master and I am still getting the error above when trying to convert each node from it's own master to a slave to the license master?

[thomas_forbes]

Nothing has changed I am still getting the same error message.

[masonmorales · Accepted solution]

That error indicates that the license master clients (i.e. your indexers and search heads) have a different pass4SymmKey configured than what is configured on the license master.

In server.conf on each client, edit the [general] stanza with
pass4SymmKey = yoursecuritykey

Then, restart Splunk. If you don't know what the pass4SymmKey is set to on your license master, change it, restart the license master, then make it the same on all of your LM clients and restart them as well.

[thomas_forbes]

All of my pass4SymmKey settings are identical to the License Master and I am still having no luck adding the indexer nodes or the Search head to my master license. I have no idea what is going on and it seems there is some sort of flaw.

Also, which node is generally considered the License Master (Search head, Master node)?

Tom Forbes

[masonmorales]

I use a separate VM for my LM but you could put it anywhere. I have seen it on both CMs and SHs. I think you may need to open a support case for your question.

[thomas_forbes]

What else could be causing this error message?

Failed to contact license master: reason='WARN: path=/masterlm/usage: invalid signature on request from ip=xxx.xxx.xxx.xxx'.....

Like I have stated before above, all of the pass4SymmKeys are identical to the master license server. Everytime I try to convert one of my indexers to a slave indexer it does not work ever. It makes me think something is really wrong with how Splunk does it's licensing.