Hi,
I'm getting the following error. Could someone help with debugging this?
Splunk 6.4.1
DB Connect 2.2.0
[INFO] [mi_base.py], line 187: action=caught_exception_in_modular_input_with_retries modular_input=mi_input://test retrying="1 of 6" error=HTTP 402 Payment Required --
In handler 'shclusterconfig': Requires license feature='DistSearch'
Traceback (most recent call last):
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\mi_base.py", line 178, in run
should_execute = runner.pre_run()
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\mi_base.py", line 118, in pre_run
should_execute = self.clustering_precheck()
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\mi_base.py", line 103, in clustering_precheck
shc_cluster_config = ShcClusterConfig(splunk_service)
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\shc_cluster_config.py", line 9, in __init__
client.Entity.__init__(self, service, 'shcluster/config', **kwargs)
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\client.py", line 872, in __init__
self.refresh(kwargs.get('state', None)) # "Prefresh"
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\client.py", line 1011, in refresh
self._state = self.read(self.get())
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\client.py", line 981, in get
return super(Entity, self).get(path_segment, owner=owner, app=app, sharing=sharing, **query)
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\client.py", line 738, in get
**query)
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\binding.py", line 286, in wrapper
return request_fun(self, *args, **kwargs)
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\binding.py", line 68, in new_f
val = f(*args, **kwargs)
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\binding.py", line 660, in get
response = self.http.get(path, self._auth_headers, **query)
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\binding.py", line 1150, in get
return self.request(url, { 'method': "GET", 'headers': headers })
File "F:\Program Files\splunk\etc\apps\splunk_app_db_connect\bin\dbx2\..\splunk_client\..\splunk_sdk-1.5.0-py2.7.egg\splunklib\binding.py", line 1205, in request
raise HTTPError(response)
HTTPError: HTTP 402 Payment Required --
In handler 'shclusterconfig': Requires license feature='DistSearch'
You need to setup your server as slave with your license server or review you don't have an invalid license.
After a proper license install, it seems to work fine now.
Hope this helps anyone else.
New DB connector feature is called "Identity": identity links an identity to a Splunk's user, but authentication is not available on a Free License, i.e. a License Master is needed to work with more than one connection. Also DB connections con be asssigned to a specific index, i.e. the DB Connector nodes needs to be indexers, so if the node is a Free Trial license, it is limited to 500 MB/day.
I got answer from our splunk partner. DBX Connect 2 require enterprise license in the forwarder (if not after 2 months the forwarder stop working). We had to associated it with master licence server
Hello
Exactly, this is because the DBX 2 app relies on roles and features, and are needed to work properly. After 2 months, the HF License expires (is an enterprise trial) and switchs to free license, disabling roles and other features that are not available in the free license.
Regards
You need to setup your server as slave with your license server or review you don't have an invalid license.
After a proper license install, it seems to work fine now.
Hope this helps anyone else.
Hi,
have the the same error. All my inputs became disabled with no data forwarding to the indexer.
Can I expect changing server to slave will resolve it, did you have the same picture ?
Indeed, when you configure the server as a slave, you will inherit the license server configuration (you must configure it) and return to index properly.
After updating Splunk on HF to ver 6.4 it became Hunk.
Thats correct
You simply need to configure your splunk instance to find the license server.
settings >> Licensing >> Associate to license server
And you should obtain a message like this:
This server is Associated with a remote master license to local master ServerSwitch
Don't have Licensing >> Associate to license server, instead there's "Licensing >> Change to slave >> Designate a different Splunk instance as the master license server". Is this the same? Sorry for this clarifications, but I need to be sure we're not doing something wrong )
It is exactly as you mention, sorry if I made you doubt about messages
It is a totally safe action, so you can make the change without problem.
Discuss then if it worked.
Yes, this solution worked! So we had Heavy Forwarder with Free forwarder license and turned it to Slave. (We've also contacted Support for this issue and this was their recommendation as well). Thank you.