Splunk Search

Why do we get the exited with code 255 errors?

ddrillic
Ultra Champion

When we search (on stage) using index = <index name>, no results come up and we get the following -

2 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.
    [<indexer1>] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
    [<indexer2>] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.

What can it be?

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I noticed you said (on stage). Does this mean you are searching production from staging? Do all the apps exist in both locations?

For example, you have a staging app called Stage_Search. You are in this app context, and try to do a distributed search to production. If Stage_Search does not exist as an app on the production indexers, it might throw a 255. Create the app on the indexers, doesn't need anything in it, just a stub is fine.

splunk create app Stage_Search

Do that on all the indexers (or use CM to push if in a cluster) and try your search again.

0 Karma

ddrillic
Ultra Champion

As far as I can recall, we ran out of disk space on the server.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...