All Apps and Add-ons

Error code 255 on Sentiment App

Path Finder


I'm getting this error:

External search command 'sentiment' returned error code 255. Script output = "ERROR "Search results do not have the specified text field: ""text""" "

I'm using a field called "text" from my twitter feed that holds the tweet text. Often the tweets don't have a text field, I have tried a couple ways to interrogate for a field, but it seems like this should catch a tweet like a Delete that has no text.

text=* AND text!="" $searchTerms$ | sentiment twitter text | eval sentiment=if(sentiment==1.0, "Positive", "Negative") | rename sentiment as Sentiment | chart count by Sentiment

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

This has been seen on distributed environments. The fix is to go into commands.conf, and set "local = true" for each of the four custom commands. Copy commands.conf to local before you do this. See below.

filename =
retainsevents = true
streaming = true
local = true **<-- add this here**
supports_getinfo = false
run_in_preview = true
enableheader = false
#changes_colorder = true
#overrides_timeorder = false
supports_rawargs = true

Do the same for language, tokens, and heat commands in the same file. A restart should not be required.

0 Karma


This didn't seem to work in fixing my error. Did I spread it too widely? I sent it out via DS to my SH and Indexers.

I added the local = true throughout the four stanzas of the commands.conf.


0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...