How do I match Licence Hash to Licence GUID?

[scodenton]

Hello,

I can find my Enterprise licence GUID in https://splunkcommunities.force.com, but when I look in my Splunk instance at Settings -> Licensing -> All licence details, all I can see is a licence Hash.

Does anyone know how I can relate the two so that I can finally work out which Splunk instance is using what licence please? This is a situation I have inherited from previous dev teams and so I don't have the full history of what was done when with what licence.

We don't have a complex setup, no forwarders or slaves, etc.

Any help would be much appreciated.

[coreybfoulds]

There is an api call that gives you this information in a more standard way.

https://yourinstance:8089/services/licenser/localslave

This will give you the guid, license hash, and you can tell if the server is a license manager or not by comparing the master_guid and slave_id fields. If they are the same, you are talking to your license manager, and if they are different, you are dealing with a server with a license managed by another server.

For license managers, you can call:

https://yourinstance:8089/services/licenser/licenses

This will give expiration and start date info for all licenses that come with that server. Slave servers will not have any of this information here.

[Azeemering · Accepted solution]

Allright, there is a naughty exploit that you can use for this.

http://yourinstance:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json
This output contains your GUID and LicenseKey and LicenseSignature.

Does this help you?

[scodenton]

Yes it did help - many thanks indeed!