All Apps and Add-ons

Error code 255 on Sentiment App

Path Finder


I'm getting this error:

External search command 'sentiment' returned error code 255. Script output = "ERROR "Search results do not have the specified text field: ""text""" "

I'm using a field called "text" from my twitter feed that holds the tweet text. Often the tweets don't have a text field, I have tried a couple ways to interrogate for a field, but it seems like this should catch a tweet like a Delete that has no text.

text=* AND text!="" $searchTerms$ | sentiment twitter text | eval sentiment=if(sentiment==1.0, "Positive", "Negative") | rename sentiment as Sentiment | chart count by Sentiment

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

This has been seen on distributed environments. The fix is to go into commands.conf, and set "local = true" for each of the four custom commands. Copy commands.conf to local before you do this. See below.

filename =
retainsevents = true
streaming = true
local = true **<-- add this here**
supports_getinfo = false
run_in_preview = true
enableheader = false
#changes_colorder = true
#overrides_timeorder = false
supports_rawargs = true

Do the same for language, tokens, and heat commands in the same file. A restart should not be required.

0 Karma


This didn't seem to work in fixing my error. Did I spread it too widely? I sent it out via DS to my SH and Indexers.

I added the local = true throughout the four stanzas of the commands.conf.


0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...