Installation Manual

Migrate to the new Splunk Enterprise licenser

This topic discusses how to migrate your license configuration from a pre-4.2 Splunk Enterprise deployment to the 4.2+ licenser model.

Note: This topic does not cover upgrade of an entire Splunk Enterprise deployment. Review "How to upgrade Splunk" in the Installation Manual before you upgrade your Splunk Enterprise deployment.

Before you proceed, you might want to review these topics:

• Read "How Splunk licensing works" in the Admin manual for an introduction to Splunk licensing.
• Read "Groups, stacks, pools, and other terminology" in the Admin manual for more information about Splunk license terms.

Old licenses

Migrating from an older version most likely puts you in one of these two categories:

• If you are currently running Splunk Enterprise 4.0 or later, your license will work in 4.2 and later.
• If you're migrating from a version older than 4.0, you must contact your Splunk Sales representative and arrange for a new license. Splunk also recommends you review the migration documentation before proceeding with the migration. Depending on how old your version of Splunk is, you might want to migrate in multiple steps (for example, first to 4.0, then 4.1, 4.2, and finally 5.0+) to maintain your configurations.

Migrating search heads

If your search heads were previously using old forwarder licenses, they will be automatically converted to be in the Download-trial group. Before you proceed, Splunk recommends adding your search heads to an established Enterprise license pool. Even if they have no indexing volume, this will enable Enterprise features, especially alerting and authentication.

Migrate a standalone instance

If you've got a single 4.1.x Splunk Enterprise indexer and it has a single license installed on it, you can just proceed as normal with your upgrade. Follow the instructions in the Installation Manual for your platform, and be sure to read the "READ THIS FIRST" documentation prior to migrating.

Your existing license will work with the new licenser, and will show up as a valid stack, with the indexer as a member of the default pool.

Migrate a distributed indexing deployment

If you've got multiple 4.1.x indexers, each with their own licenses, follow these high-level steps in this order to migrate the deployment:

1. Designate one of your Splunk Enterprise instances as the license master. If you've got a search head, this is likely a good choice.

2. Install or upgrade the Splunk Enterprise instance you have chosen to be the license master, following the standard instructions in the Installation Manual.

3. Configure the license master to accept connections from the indexers as desired.

4. Upgrade each indexer one at a time, following these steps:

• Upgrade an indexer to 5.0 following the instructions in the Installation Manual. It will be operating as a stand-alone license master until you perform the following steps.
• Make a copy of the indexer's Enterprise license file (pre-4.2 license files are located in $SPLUNK_HOME/etc/splunk.license on each indexer) and install it onto the license master, adding it to the stack and pool to which you want to add the indexer.
• Configure the indexer as a license slave and point it at the license master.
• On the license master, confirm that the license slave is connecting as expected by navigating to Manager > Licensing and looking at the list of indexers associated with the appropriate pool.
• Once you've confirmed the license slave is connecting as expected, proceed to upgrade the next indexer, following the same steps.

Migrate forwarders

If you have deployed light forwarders, review the information in this chapter about the universal forwarder in the Forwarding Data Manual. You can upgrade your existing light forwarders to the universal forwarders, no licensing configuration is required--the universal forwarder includes its own license.

If you have deployed a heavy forwarder (a full instance of Splunk that performs indexing before forwarding to another Splunk Enterprise instance), you can treat it like an indexer--add it to a license pool along with the other indexers.