All Apps and Add-ons

Error code 255 on Sentiment App

Path Finder


I'm getting this error:

External search command 'sentiment' returned error code 255. Script output = "ERROR "Search results do not have the specified text field: ""text""" "

I'm using a field called "text" from my twitter feed that holds the tweet text. Often the tweets don't have a text field, I have tried a couple ways to interrogate for a field, but it seems like this should catch a tweet like a Delete that has no text.

text=* AND text!="" $searchTerms$ | sentiment twitter text | eval sentiment=if(sentiment==1.0, "Positive", "Negative") | rename sentiment as Sentiment | chart count by Sentiment

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

This has been seen on distributed environments. The fix is to go into commands.conf, and set "local = true" for each of the four custom commands. Copy commands.conf to local before you do this. See below.

filename =
retainsevents = true
streaming = true
local = true **<-- add this here**
supports_getinfo = false
run_in_preview = true
enableheader = false
#changes_colorder = true
#overrides_timeorder = false
supports_rawargs = true

Do the same for language, tokens, and heat commands in the same file. A restart should not be required.

0 Karma


This didn't seem to work in fixing my error. Did I spread it too widely? I sent it out via DS to my SH and Indexers.

I added the local = true throughout the four stanzas of the commands.conf.


0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...