topic Re: search problem in Splunk Search

search problem

aalaa — Fri, 29 Nov 2019 14:20:27 GMT

Hello ,

I'm getting the following error in the Search head. How do I troubleshoot?

Search process did not exit cleanly, exit_code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.

Any help please ?

Re: search problem

to4kawa — Fri, 29 Nov 2019 14:51:39 GMT

what's your query?

Re: search problem

aalaa — Fri, 29 Nov 2019 15:13:44 GMT

All the searchs are blocked !
in my distributed environment, when I execute a search index=_internal or any other search from the search head, I don't get any results back. When I log into an indexer directly and perform the same search, the expected results are returned. I can see from the "Indexes" pages that there are definitely events in the _internal index on each indexer, but I don't seem to be able to access them from the search head.

Re: search problem

to4kawa — Fri, 29 Nov 2019 16:00:46 GMT

What Splunk software logs about itself

How did you check it?

Re: search problem

arjunpkishore5 — Fri, 29 Nov 2019 18:05:14 GMT

Searches are typically blocked when you have license violations. Have you exceeded license usage by any chance?

Re: search problem

woodcock — Fri, 29 Nov 2019 19:19:04 GMT

Go to Settings -> Licensing and it should clearly tell you that you have either an expired/invalid license or too many license violations and give you some options on how to proceed.

Re: search problem

wmyersas — Fri, 29 Nov 2019 19:36:37 GMT

sounds like a permissions or license issue