Developing for Splunk Enterprise

Why am I getting this error "External search command 'File_Move1' returned error code 1" every time I run my python script?


• I am trying to execute python script FileMove1 using the search query |script FileMove1 but received the error below:
External search command 'File_Move1' returned error code 1.

• Please find my commands.conf details below in my C:\Program Files\Splunk\etc\system\local

chunked = true
filename =
type = python

• I have placed the file in bin directory of C:\Program Files\Splunk\etc\apps\search\bin\scripts and C:\Program Files\Splunk\bin\scripts but still I receive that error
• I was able to execute the same script using Splunk cmd python using command prompt.

I kindly request you to look into it and guide me how to get rid of that error. I really appreciate your help on this.

Labels (1)

Super Champion

Try running below:

< search query>| script python 


0 Karma



Thank you for the help on this.

I have tried index="test" | script python FileMove1 or index="test" | script python
earlier but still no luck. Could you please advise with any other fix.


hi Vipun. i have the same error message -- i'm playing with Splunk REST API functionality now. i think you have to dig the script itself first.
in my case there was simply a syntactic error in my python code.
don't give up, good luck 🙂

0 Karma


Hi 493669,

I have followed that earlier but still, I get the same error

index="test" | script python 


index="test" | script python File_Move1

⚠ External search command 'File_Move1' returned error code 1.
Please suggest any answers. Thank you for the help!!