Getting Data In

How to get a list of indexers reporting into our license manager via REST API?

a212830
Champion

Hi,

I want to get a list of indexers reporting into our license manager via REST API. Many of these we do not manage, but we are responsible for the license mgmt. I tried using | rest count=0 /services/licenser/slaves, but that also reports the heavy forwarder. Is there a way (via REST) to list only the indexers being reported on by the license manager? Something similar to what appears under the licensing page, under the license stacks.

Does the Heavy Forwarder need to be pointed at the license mgr if it's not indexing? Looking at this: https://docs.splunk.com/Documentation/Splunk/6.5.0/Admin/TypesofSplunklicenses - it seems to indicate that isn't necessary. How would I "manually converted to the Forwarder license group" ?

0 Karma

sloshburch
Splunk Employee
Splunk Employee

What about a correlation of slaves from the REST endpoint that also show up in the license_usage.log during that time period. Wouldn't that show just splunk installs doing indexing?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can enable the forwarder license on your Heavy forwarders by running following commands. Once they are converted to Forwarder License, they'll no longer be slave to License master and your rest api query would return only indexers.

$SPLUNK_HOME/bin/splunk edit licenser-groups Forwarder -is_active 1
$SPLUNK_HOME/bin/splunk restart
0 Karma

a212830
Champion

Tried that and received this:

[splunk@vlmmk301 bin]$ ./splunk edit licenser-groups Forwarder -is_active 1
Your session is invalid. Please login.
Splunk username: admin
Password:

In handler 'groups': no stacks/licenses corresponding to group=Forwarder

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What version of Splunk are you using on your Heavy Forwarders?

Also, try adding this to server.conf on your heavy forwarder ($SPLUNK_HOME/etc/system/local/server.conf)

[license]
active_group =  Forwarder 

Restart Splunk afterwards.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

If you use ./splunk list licenses you can see what's you've got to play with. Use ./splunk help list to see the list of options.

$ /opt/splunk_dev/bin/splunk edit licenser-groups Forwarder -is_active 1
The licenser-groups object has been edited.

That only worked on an instance where I had a Forwarder license stanza in my local/server.conf.

0 Karma

a212830
Champion

I did | rest count=0 /services/licenser/slaves - same thing, no?

0 Karma

lycollicott
Motivator

Yes, that will do the same thing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...