Splunk® Enterprise

Installation Manual

Acrobat logo Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Acrobat logo Download topic as PDF

Migrate to the new Splunk Enterprise licenser

This topic discusses how to migrate your license configuration from a pre-4.2 Splunk Enterprise deployment to the 4.2+ licenser model.

Note: This topic does not cover upgrade of an entire Splunk Enterprise deployment. Review "How to upgrade Splunk" in the Installation Manual before you upgrade your Splunk Enterprise deployment.

Before you proceed, you might want to review these topics:

Old licenses

Migrating from an older version most likely puts you in one of these two categories:

  • If you are currently running Splunk Enterprise 4.0 or later, your license will work in 4.2 and later.
  • If you're migrating from a version older than 4.0, you must contact your Splunk Sales representative and arrange for a new license. Splunk also recommends you review the migration documentation before proceeding with the migration. Depending on how old your version of Splunk is, you might want to migrate in multiple steps (for example, first to 4.0, then 4.1, 4.2, and finally 5.0+) to maintain your configurations.

Migrating search heads

If your search heads were previously using old forwarder licenses, they will be automatically converted to be in the Download-trial group. Before you proceed, Splunk recommends adding your search heads to an established Enterprise license pool. Even if they have no indexing volume, this will enable Enterprise features, especially alerting and authentication.

Migrate a standalone instance

If you've got a single 4.1.x Splunk Enterprise indexer and it has a single license installed on it, you can just proceed as normal with your upgrade. Follow the instructions in the Installation Manual for your platform, and be sure to read the "READ THIS FIRST" documentation prior to migrating.

Your existing license will work with the new licenser, and will show up as a valid stack, with the indexer as a member of the default pool.

Migrate a distributed indexing deployment

If you've got multiple 4.1.x indexers, each with their own licenses, follow these high-level steps in this order to migrate the deployment:

1. Designate one of your Splunk Enterprise instances as the license master. If you've got a search head, this is likely a good choice.

2. Install or upgrade the Splunk Enterprise instance you have chosen to be the license master, following the standard instructions in the Installation Manual.

3. Configure the license master to accept connections from the indexers as desired.

4. Upgrade each indexer one at a time, following these steps:

  • Upgrade an indexer to 5.0 following the instructions in the Installation Manual. It will be operating as a stand-alone license master until you perform the following steps.
  • Make a copy of the indexer's Enterprise license file (pre-4.2 license files are located in $SPLUNK_HOME/etc/splunk.license on each indexer) and install it onto the license master, adding it to the stack and pool to which you want to add the indexer.
  • Configure the indexer as a license slave and point it at the license master.
  • On the license master, confirm that the license slave is connecting as expected by navigating to Manager > Licensing and looking at the list of indexers associated with the appropriate pool.
  • Once you've confirmed the license slave is connecting as expected, proceed to upgrade the next indexer, following the same steps.

Migrate forwarders

If you have deployed light forwarders, review the information in "Migrate from a light forwarder" in the Forwarding Data Manual. You can upgrade your existing light forwarders to the universal forwarders, no licensing configuration is required--the universal forwarder includes its own license.

If you have deployed a heavy forwarder (a full instance of Splunk that performs indexing before forwarding to another Splunk Enterprise instance), you can treat it like an indexer--add it to a license pool along with the other indexers.

Last modified on 10 February, 2016
Migrate a Splunk Enterprise instance
Uninstall Splunk Enterprise

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters