Deployment Architecture

exit_code=255 ERROR dispatchRunner

LordLeet
Path Finder

Hello,

I am expanding my environment from an Indexer Cluster composed by one Indexer and two Search Heads, to an Indexer Cluster with five Search Heads.

Each Search Head should have a set of specific apps, that we have developed, and one of those apps has minor changes to its content and its name based on the Search Head they are being deployed at.

Sometimes, when I run a search, within the previously mentioned app context, I'm getting the following error:

Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.

Inspecting the log it contains the following ERROR:

ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Application does not exist: <app_name>

The app exists, since I'm running the search in it.

I do not have a Deployment Server so the apps are being deployed manually on the Search Heads.

I'm having trouble finding the root cause of the issue since sometimes the Searches work and some times they do not,I've tried:

  • Deploying the app via the webclient;
  • Deploying the app via the console;
  • Playing with the app permissions;

Does anyone have some advice on how to fix this?
I've already looked for similar questions on the forum and so far none of the accepted answers helped me.

Thanks in advance!

0 Karma

joshuamcqueen
Path Finder

Solution: Rename the app and deploy to search heads.

joshuamcqueen
Path Finder

I am having the exact same issue you describe. All nodes are Splunk 7.0.2.

Very simple app -- just a dashboard and some panels -- yet sometimes it works, sometimes it doesn't.

Setup: 1 SH --> 3 Indexers. No clustering.

Did you figure it anything out?

0 Karma

LordLeet
Path Finder

Hey joshuamcqueen,

What seemed to fix the issue for me was renaming the app, so all search heads had the same one, even though the content differs.

I can't for sure guarantee it fixed the issue, but so far I haven't faced the error again.

To which instances are you deploying the app?

Regards

0 Karma

joshuamcqueen
Path Finder

Yup! Renaming must have fixed it on our end too. Haven't seen the "red triangle of doom" pop back up yet. Marking as solved.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...