"This license does not support being a remote master" error on Splunk Enterprise trial - why?

[Monica7]

I have a Linux server with Splunk Enterprise and splunk heavy forwarder installed. In the splunk log, I am getting this error. Could you please help me in resolving this error.

I am using trial license in this development Splunk enterprise .

ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip =XX.XX.XX.XX

[mattymo]

Had to post a new answer as we used all the comments on my original answer:

Step 1: Log into the GUI of your Heavy Forwarder.
Step 2: Settings > Licensing
Step 3: Press radio button to switch to local master.

Done.

You don't have to change IPs or anything like that. The issue is that you pointed the Heavy Forwarder at the Splunk Enterprise instance as a license master. You cannot do that on the free license.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Configurealicensemaster

[Monica7]

thanks Modestino.After following the instructions given by you, this is the screen output . Please check and let me know it is correct. Now I am not getting any error regarding license in splunkd.log

This server is acting as a standalone license server Change to slave
Trial license group
Change license group
This server is configured to use licenses from the Trial license group
Add licenseUsage report
Alerts
Licensing alerts notify you of excessive indexing warnings and licensing misconfigurations. Learn more
Current
No licensing alerts
Permanent
No licensing violations
Local server information

Indexer name XXXXXXX[Splunk enterprise server Host name]
License expiration Dec 3, 2017 3:29:39 PM
Licensed daily volume 500 MB
Volume used today 0 MB (0% of quota)
Warning count 0
Debug information All license details
All indexer details

[mattymo]

yep! all good until the trial expires or you get a full license. please feel free to visit dev.splunk.com to get a dev license that you can renew every 6 months!

[Monica7]

Thanks Modestino for helping me to get the issue resolved. where can I find the license expiration info?

In splunk GUI or splunk heavy forwarder GUI?

[mattymo]

my pleasure.

Please be sure to accept the first answer I provided as it seems to have answered your question.

You can find the license info in BOTH the Splunk Enterprise GUI and the Heavy Forwarder GUI Under Settings > Licensing.

I suggest you take some time to review the documentation

[Monica7]

Thanks Modestino. I have accepted your answer. I will check for the dev license site for getting the dev license.

Thank you again

[mattymo]

enjoy! Let us know how it goes!

you can join a large community of splunkers for tips and tricks at splunk-usergroups.slack.com too to accelerate your learning curve!

[mattymo · Accepted solution]

Hi Monica,

The Enterprise trial license does not support acting as a remote master.

If all the instances are using the trial, just set each instance to be it's own master.

Settings > Licensing > set to Master.

If you would like to test remote license master functionality, I suggest you go to dev.splunk.com and get a 10 GB dev license which is fully featured.

[Monica7]

I don't find set to Master option in settings->Licensing page

Licensing
This server is acting as a standalone license server Change to slave
Trial license group
Change license group
This server is configured to use licenses from the Trial license group
Add licenseUsage report
Alerts
Licensing alerts notify you of excessive indexing warnings and licensing misconfigurations. Learn more
Current
1 pool warning reported by 1 indexer Correct by midnight to avoid violation Learn more
Permanent
1 pool quota overage warning reported by 1 indexer 4 days ago

[mattymo]

which host is this on? did you check both? This example you gave seems to be set ok. Check for any instances pointing at another instance for licensing. the log should tell you which host the event came from and which IP is trying to connect.

[Monica7]

10-05-2017 17:06:13.358 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=5 AppEvents from DC ip=xx.xx.xx.xx[**UniversalforwarderServer1] name=C4B5644E-48AF-4919-B16E-DE5809D2B132
10-05-2017 17:06:30.998 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=5 AppEvents from DC ip=xx.xx.xx.xx[UniversalforwarderServer2] name=47E99D8A-38E8-4EF8-AD6F-0B994E6E9664
10-05-2017 17:06:43.739 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=8 AppEvents from DC ip=xx.xx.xx.xx[**UniversalforwarderServer3] name=A416CC44-2A2D-4C49-8FBC-8FEBB768261D
10-05-2017 17:06:57.925 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server]
10-05-2017 17:07:02.140 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=12 AppEvents from DC ip=xx.xx.xx.xx[UniversalforwarderServer4] name=3DCF6768-1AB6-4A2C-BFA1-D866BD962668
10-05-2017 17:07:06.984 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=10 AppEvents from DC ip=xx.xx.xx.xx[**UniversalforwarderServer5] name=45BE1CBC-C7AA-44C8-80A8-92B31FE400B2
10-05-2017 17:07:57.925 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server]
10-05-2017 17:08:58.928 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server*]
10-05-2017 17:09:39.268 +0530 INFO ClientSessionsManager:Listener_AppEvents - Received count=6 AppEvents from DC ip=xx.xx.xx.xx[Splunk enterprise server] name=1460741B-03D5-4013-AD62-2F72D217CFAA
10-05-2017 17:09:59.927 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server*]
10-05-2017 17:10:59.926 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server***]

I am trying to monitor the application logs from 5 servers [I have installed universal forwarder on all 5 servers] and forwarding the logs to 6th server, where splunk enterprise and splunk heavy forwarder is installed. in the splunk enterprise server I am getting the above error which is mentioned in this post.

[mattymo]

10-05-2017 17:06:57.925 +0530 ERROR LMMasterRestHandler - path=/masterlm/usage: This license does not support being a remote master. from ip=xx.xx.xx.xx[Splunk enterprise server]

what machine owns the IP in this log??Is it the IP of your enterprise server??? Or is the IP of another server?

The universal forwarders should be fine, as they do not require a license.

I would check the Heavy Forwarder config to make sure you didn't point it at the Enterprise Install for licensing.

If that is not the case, then the other thing to look for might be distributed search functions. I believe those are locked down too. Did you try and set up search peers??

https://www.splunk.com/en_us/products/features-comparison-chart.html

The best way to not have to worry about any of this, is to go to dev.splunk.com and get a free 10GB dev license which is fully featured.

Other than seeing this in your logs, are you running into any issues or unable to use a function that you want to use??

[Monica7]

what machine owns the IP in this log??Is it the IP of your enterprise server??? Or is the IP of another server?

Yes it is the IP of the splunk enterprise server.

If that is not the case, then the other thing to look for might be distributed search functions. I believe those are locked down too. Did you try and set up search peers??
All server logs are getting monitored except splunk enterprise rhel logs

apart from this above two issues I am not facing any issues.
I would check the Heavy Forwarder config to make sure you didn't point it at the Enterprise Install for licensing.
can you please tell me the file name of the heavy forwarder configuration which you need?so that I can share it with you.

The best way to not have to worry about any of this, is to go to dev.splunk.com and get a free 10GB dev license which is fully featured.
I will check on this if these issues are not resolved.

[mattymo]

try running ./splunk btool server list license --debug on your heavy forwarder, or just log into the Heavy forwarder and check under Settings > Licensing to confirm that is is acting as a master and is not pointing to your Enterprise instance.

For example, here is my standalone License master:

[splunker@n00bserver bin]$ ./splunk btool server list license --debug
/home/splunker/splunk/etc/system/local/server.conf   [license]
/home/splunker/splunk/etc/system/local/server.conf   active_group = Enterprise
/home/splunker/splunk/etc/system/default/server.conf connection_timeout = 30
/home/splunker/splunk/etc/system/default/server.conf master_uri = self
/home/splunker/splunk/etc/system/default/server.conf receive_timeout = 30
/home/splunker/splunk/etc/system/default/server.conf report_interval = 1m
/home/splunker/splunk/etc/system/default/server.conf send_timeout = 30
/home/splunker/splunk/etc/system/default/server.conf squash_threshold = 2000
/home/splunker/splunk/etc/system/default/server.conf strict_pool_quota = true

The key here being master URI. I am assuming somewhere along the line in your set up, you have either configured the master URI on the HF, or you have configured a setting not supported by the standalone. Being that the error is the rest call (LMMasterRestHandler) someone is calling the Enterprise Instance as a slave, which is not supported on the trial.

[Monica7]

Hi Please find the command output below.
[root@************** bin]# ./splunk btool server list license --debug
/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf [license]
/appl/splunkheavyforwarder/etc/system/default/server.conf connection_timeout = 30
/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri = https://xx.xx.xx.xx[Splunk enterprise server ip]:8089
/appl/splunkheavyforwarder/etc/system/default/server.conf receive_timeout = 30
/appl/splunkheavyforwarder/etc/system/default/server.conf report_interval = 1m
/appl/splunkheavyforwarder/etc/system/default/server.conf send_timeout = 30
/appl/splunkheavyforwarder/etc/system/default/server.conf squash_threshold = 2000
/appl/splunkheavyforwarder/etc/system/default/server.conf strict_pool_quota = true

Licensing
This server is associated with a remote master license serverSwitch to local master
Local server information

Indexer name XXXXXXXXXXXXX
Master server URI https://xx.xx.xx.xx[Splunk Enterprise server IP]:8089
Last successful contact time 2 days ago (10/4/17 3:44 PM)
Messages Show all messages

Show all configuration details

[mattymo]

thats your issue right there:

/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri = https://xx.xx.xx.xx[Splunk enterprise server ip]:8089

Licensing
This server is associated with a remote master license serverSwitch to local master
Local server information

You cannot point to a remote master on trial license. Switch to local master on the HF and you are good to go!

[Monica7]

Hi Modestino,

local master means? Do I need to change the IP or do I need to change the port in this line?/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri =

if I want to change the IP means, What I have to change?
because in my case I am having Server A, where both Splunk enterprise and Splunk heavy forwarder is installed in the same server[A]. Server B,C,D,E,F is having universal forwarder installed in order to forward the application logs to Splunk heavy forwarder, whereas it will forward the log to splunk enterprise instance.

Currently I have mentioned ServerA ip here.
/appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri = https://xx.xx.xx.xx[Splunk enterprise server ip]:8089

In case if I want to change the IP in this line. Which server IP I have to mention here. Kindly help me on this?in /appl/splunkheavyforwarder/etc/apps/wq_full_license_server/local/server.conf master_uri =