Splunk® Enterprise

Admin Manual

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Manage licenses from the CLI

This topic describes using the Splunk CLI to monitor and manage your Splunk licenses. Before you continue, review these topics:

This topic only covers what CLI commands you can use to interact with Splunk's licenser-related objects. Some of these commands also have required and optional arguments that you can specify for each object. For the complete syntax and usage examples, refer to Splunk's CLI help.

  • Read "About the CLI" in this manual for an introduction to using the Splunk command line interface.

For information on managing licenses through Splunk's REST API, refer to "Licenses" in the REST API Reference Manual.

CLI licenser commands and objects

Using the Splunk CLI, you can add, edit, list, and remove licenses and licenser-related objects. The available commands are:

Command Object(s) Description
add licenses, licenser-pools Add a license or a pool of licenses to a license stack. This command is only available if you have an Enterprise license.
edit licenser-localslave, licenser-pools Edit the attributes of a local licenser-slave node or a pool of licenses within a license stack. This command is only available if you have an Enterprise license.
list licenser-groups, licenser-localslave, licenser-messages, licenser-pools, licenser-slaves, licenser-stacks, licenses Depending on the licenser-related object specified, lists either the attributes of that object or members of that object.
remove licenser-pools, licenses Remove licenses or license pools from a license stack.

License-related objects are:

Object Description
licenser-groups the different license groups you can switch to.
licenser-localslave a local indexer's configuration.
licenser-messages the alerts or warnings about the state of your licenses.
licenser-pools a pool, or virtual license. A stack can be divided into various pools, with multiple slaves sharing the quota of each pool.
licenser-slaves all the slaves that have contacted the master.
licenser-stacks this object represents a stack of licenses. A stack contains licenses of the same type and are cumulative.
licenses all licenses for this Splunk instance.

Common licenser-related tasks

The following are examples of common licenser-related tasks.

Managing licenses

To add a new license to the license stack, specify the path to the license file:

./splunk add licenses /opt/splunk/etc/licenses/enterprise/enterprise.lic 

To list all the licenses in a license stack:

./splunk list licenses

List also displays the properties of each license, including the features it enables (features), the license group and stack it belongs to (group_id, stack_id), the indexing quote it allows (quota), and the license key that is unique for each license (license_hash).

If a license expires, you can remove it from the license stack. To remove a license from the license stack, specify the license's hash:

./splunk remove licenses BM+S8VetLnQEb1F+5Gwx9rR4M4Y91AkIE=781882C56833F36D

Managing license pools

You can create a license pool from one or more licenses in a license stack (if you have an Enterprise license). Basically, a license stack can be carved up into multiple licenser pools. Each pool can have more than one license slave sharing the quota of the pool.

To see all the license pools in all the license stacks:

./splunk list licenser-pools

To add a license pool to the stack, you need to: name the pool, specify the stack that you want to add it to, and specify the indexing volume allocated to that pool:

./splunk add licenser-pools pool01 -quota 10mb -slaves guid1,guid2 -stack_id enterprise

You can also specify a description for the pool and the slaves that are members of the pool (these are optional).

You can edit the license pool's description, indexing quota, and slaves:

./splunk edit licenser-pools pool01 -description "Test" -quota 15mb -slaves guid3,guid4 -append_slaves true

This basically adds a description for the pool, "Test", changes the quota from 10mb to 15mb, adds slaves guid3 and guid4 to the pool (instead of overwriting or replace guid1 and guid2).

To remove a license pool from a stack, specify the name:

./splunk remove licenser-pools pool01

Managing license slaves

A license slave is a member of one or more license pools. The license slaves access to license volume is controlled by its license master.

To list all the license slaves that have contacted the license master:

./splunk list licenser-slaves

To list all the properties of the local license slave:

./splunk list licenser-localslave

To add a license slave, edit the attributes of that local license slave node (specify the uri of the splunkd license master instance or 'self'):

./splunk edit licenser-localslave -master_uri 'https://master:port'

Monitoring license status

You can use the list command to view messages (alerts or warnings) about the state of your licenses.

./splunk list licenser-messages
Swap the license master
About license violations

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11


For a Heavy Forwarder (with no local indexing), all you need is this:

splunk edit licenser-groups Forwarder -is_active 1

Je zayo
April 17, 2018

The "add licenses" command copies the license file to the $SPLUNK_HOME/etc/licenses/enterprise directory. Running "./splunk add licenses /opt/splunk/etc/licenses/enterprise/enterprise.lic" would create a duplicate license file /opt/splunk/etc/licenses/enterprise/enterprise-1.lic right next to the one being added, which is confusing and not the intent. Licenses should not be copied to the $SPLUNK_HOME/etc/licenses/enterprise directory before being added. This article's implication sets a bad example.

February 7, 2018

Thanks, Graether! Fixed.

Jlaw splunk, Splunker
February 23, 2016

To remove a license pool from a stack, specify the name: splunk remove licenser-pools pool01

February 22, 2016

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters