Splunk® Enterprise

Installation Manual

Acrobat logo Download manual as PDF

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. Click here for the latest version.
Acrobat logo Download topic as PDF

Migrate to the new Splunk Enterprise licenser

Learn how to migrate your license configuration from a Splunk Enterprise deployment that runs a version earlier than 4.2 to the 4.2 and later licenser model by following the procedures in this topic.

Note: This topic does not cover the upgrade of an entire Splunk Enterprise deployment. See How to upgrade Splunk before you upgrade your Splunk Enterprise deployment.

Before you proceed, see the following:

Old licenses

Migrating from an older version of Splunk Enterprise most likely puts you in one of these two categories:

  • If you run Splunk Enterprise 4.0 or later, your license will work in 4.2 and later.
  • If you migrate from a version of Splunk Enterprise that is older than 4.0, you must contact your Splunk Sales representative and arrange for a new license. See What to expect when upgrading to 4.0 before proceeding with the migration. Depending on how old your version of Splunk Enterprise is, you might want to migrate in multiple steps (for example, first to 4.0, then 4.1, 4.2, and finally 5.0+) to maintain your configurations.

Migrating search heads

If your search heads used old forwarder licenses, they will be automatically converted to be in the Download-trial group. Before you proceed, add your search heads to an established Enterprise license pool. Even if they have no indexing volume, this practice enables Enterprise features, especially alerting and authentication.

Migrate a standalone instance

If you've got a single 4.1.x Splunk Enterprise indexer and it has a single license installed on it, you can just proceed as normal with your upgrade. See How to upgrade Splunk for instructions, and be sure to read the "READ THIS FIRST" documentation prior to migrating.

Your existing license will work with the new licenser, and will show up as a valid stack, with the indexer as a member of the default pool.

Migrate a distributed indexing deployment

If you've got multiple 4.1.x indexers, each with their own licenses, follow these high-level steps in this order to migrate the deployment:

  1. Designate one of your Splunk Enterprise instances as the license master. A search head is a good choice if one is available.
  2. Install or upgrade the Splunk Enterprise instance you have chosen to be the license master, following the standard instructions in this manual.
  3. Configure the license master to accept connections from the indexers as desired.
  4. Upgrade each indexer one at a time, following these steps:
    1. Upgrade an indexer to 5.0 following the instructions in this manual. It will operate as a stand-alone license master until you perform the following steps.
    2. Make a copy of the indexer Enterprise license file. You can locate license files for 4.2 and earlier in $SPLUNK_HOME/etc/splunk.license on each indexer.)
  5. install the license onto the license master, adding it to the stack and pool to which you want to add the indexer.
  6. Configure the indexer as a license slave and point it at the license master.
  7. On the license master, confirm that the license slave connects as expected by navigating to Manager > Licensing and looking at the list of indexers associated with the appropriate pool.
  8. Once you confirm that the license slave connects as expected, proceed to upgrade the next indexer, following the same steps.

Migrate forwarders

If you have deployed light forwarders, review the information in Migrate from a light forwarder in the Universal Forwarder Manual. You can upgrade your existing light forwarders to the universal forwarder as the universal forwarder includes its own license.

If you have deployed a heavy forwarder (a full instance of Splunk that performs indexing before forwarding to another Splunk Enterprise instance), you can treat it like an indexer--add it to a license pool along with the other indexers.

Last modified on 21 April, 2017

This documentation applies to the following versions of Splunk® Enterprise: 6.5.7, 7.0.0

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters