Deployment Architecture

exit_code=255 ERROR dispatchRunner

Path Finder


I am expanding my environment from an Indexer Cluster composed by one Indexer and two Search Heads, to an Indexer Cluster with five Search Heads.

Each Search Head should have a set of specific apps, that we have developed, and one of those apps has minor changes to its content and its name based on the Search Head they are being deployed at.

Sometimes, when I run a search, within the previously mentioned app context, I'm getting the following error:

Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.

Inspecting the log it contains the following ERROR:

ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Application does not exist: <app_name>

The app exists, since I'm running the search in it.

I do not have a Deployment Server so the apps are being deployed manually on the Search Heads.

I'm having trouble finding the root cause of the issue since sometimes the Searches work and some times they do not,I've tried:

  • Deploying the app via the webclient;
  • Deploying the app via the console;
  • Playing with the app permissions;

Does anyone have some advice on how to fix this?
I've already looked for similar questions on the forum and so far none of the accepted answers helped me.

Thanks in advance!

0 Karma

Path Finder

Solution: Rename the app and deploy to search heads.

Path Finder

I am having the exact same issue you describe. All nodes are Splunk 7.0.2.

Very simple app -- just a dashboard and some panels -- yet sometimes it works, sometimes it doesn't.

Setup: 1 SH --> 3 Indexers. No clustering.

Did you figure it anything out?

0 Karma

Path Finder

Hey joshuamcqueen,

What seemed to fix the issue for me was renaming the app, so all search heads had the same one, even though the content differs.

I can't for sure guarantee it fixed the issue, but so far I haven't faced the error again.

To which instances are you deploying the app?


0 Karma

Path Finder

Yup! Renaming must have fixed it on our end too. Haven't seen the "red triangle of doom" pop back up yet. Marking as solved.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...