All Apps and Add-ons

Installation of Splice App causes data model searches to fail

joshua_hart1
Path Finder

When I install and enable the Splice app on my search head, dashboards that utilize data model searches fail. Errors that I receive include:

[indexer] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please log in the search.log for this peer in the job inspector for more info.

I searched the search.log and there is nothing that indicates why the search would exit. Is there a configuration within the Splice app that would interfere with data model searches?

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Make sure you also examine the search.log of indexers - by default those are not sent to the search head.

0 Karma

cleroux_splunk
Splunk Employee
Splunk Employee

SPLICE do not uses the data model searches. I don't see any reason nor configuration element that could interfere with the data model searches.

0 Karma

joshua_hart1
Path Finder

Correct. However, when I perform a data model search | datamodel ... from another app, with Splice enabled, I get the error_code=255. When I disable it, I'm able to perform the searches. It appears that Splice is getting in the way.

0 Karma

cleroux_splunk
Splunk Employee
Splunk Employee

They are similar issues already reported, none linked to Splice so far, did you deployed Splice on your Indexers as well?

Ex: http://answers.splunk.com/answers/131053/solved-error-banner-message-exit-code-255-btool-command.htm...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...