Deployment Architecture

Why am I getting an error when using the xmlkv in a search on one of my search heads?

jeffbat
Path Finder

I am trying to use the xmlkv command in a search on one of my search heads and it is returning errors. This had worked in the past so I am not sure what might have changed to start causing the issue.

The search being used is:

sourcetype=CUDL| xmlkv| top Status

The error that I am getting is:

[INDEX01] Streamed search execute failed because: Error in 'xmlkv' command: Cannot find program 'xmlkv' or script 'xmlkv'.
[INDEX02] Streamed search execute failed because: Error in 'xmlkv' command: Cannot find program 'xmlkv' or script 'xmlkv'.
[INDEX03] Streamed search execute failed because: Error in 'xmlkv' command: Cannot find program 'xmlkv' or script 'xmlkv'.

The setup we have is a non-clustered search head which is reading data from a 3 node set of clustered indexers.

All of our servers are running on Windows OS and Splunk Enterprise 6.6.3.

I have other search heads that connect to the same backend indexers for pulling data, and when executing the same command on them; the data returns as expected.

So I am thinking this is some issue on the search head triggering the errors, like a permission or something but I cannot find anything that is different from the other search heads.

Any ideas on what might be set incorrectly?

Tags (3)
0 Karma
1 Solution

jeffbat
Path Finder

That was the issue. We had adjusted what goes in the replication bundle and it was not sending over the scripts.

Adjusted that part and sure enough it is working fine once again.

Thanks.

(I would mark this as the correct answer but for some reason it is not showing me that option)

0 Karma

somesoni2
Revered Legend

Here you go (converted my comment to answer so that you can close the question).

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...