exit_code=255 ERROR dispatchRunner

[LordLeet]

Hello,

I am expanding my environment from an Indexer Cluster composed by one Indexer and two Search Heads, to an Indexer Cluster with five Search Heads.

Each Search Head should have a set of specific apps, that we have developed, and one of those apps has minor changes to its content and its name based on the Search Head they are being deployed at.

Sometimes, when I run a search, within the previously mentioned app context, I'm getting the following error:

Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.

Inspecting the log it contains the following ERROR:

ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Application does not exist: <app_name>

The app exists, since I'm running the search in it.

I do not have a Deployment Server so the apps are being deployed manually on the Search Heads.

I'm having trouble finding the root cause of the issue since sometimes the Searches work and some times they do not,I've tried:

• Deploying the app via the webclient;
• Deploying the app via the console;
• Playing with the app permissions;

Does anyone have some advice on how to fix this?
I've already looked for similar questions on the forum and so far none of the accepted answers helped me.

Thanks in advance!

[joshuamcqueen]

Solution: Rename the app and deploy to search heads.

[joshuamcqueen]

I am having the exact same issue you describe. All nodes are Splunk 7.0.2.

Very simple app -- just a dashboard and some panels -- yet sometimes it works, sometimes it doesn't.

Setup: 1 SH --> 3 Indexers. No clustering.

Did you figure it anything out?

[LordLeet]

Hey joshuamcqueen,

What seemed to fix the issue for me was renaming the app, so all search heads had the same one, even though the content differs.

I can't for sure guarantee it fixed the issue, but so far I haven't faced the error again.

To which instances are you deploying the app?

Regards

[joshuamcqueen]

Yup! Renaming must have fixed it on our end too. Haven't seen the "red triangle of doom" pop back up yet. Marking as solved.