Since upgrading to 4.3, all of the license slaves I have show login screens with the "Upgrade to Splunk Enterprise to add alerting, single sign-on blah blah..."
Previously they acknowledged their licensing as dictated by the master. The LM server shows them as slaves and properly licensed.
Today, they all suspended searching for license violations but volume is well below our licensed level. These 2 seem related.
I'm seeing the same behavior after upgrading. I just received my first license warning. Did you ever resolve this?
I've heard nothing, but continue to see the (harmless) behavior on the login screen with at least 4.3.1 systems. I've heard nothing from Splunk regarding the issue.
The issue with license violations was not related, and Splunk support helped me track it down.
The license screen on the slaves also shows good contact to the LM.