Getting Data In

Health Check: msg="A script exited abnormally with exit status: 1 issue in the ES SH.

AL3Z
Builder

Hi ,

How we can fix this issue in ES SH "Health Check: msg="A script exited abnormally with exit status: 1" input=".$SPLUNK_HOME/etc/apps/splunk-dashboard-studio/bin/save_image_and_icon_on_install.py" stanza="default"

Thanks..

Labels (1)
0 Karma

tscroggins
Influencer

Hi @AL3Z,

The cause depends on the output of save_image_and_icon_on_install.py.

Try this search:

index=_internal sourcetype=splunkd save_image_and_icon_on_install.py

Possible outcomes in Splunk Enterprise 9.1.1 / Dashboard Studio 1.11.6:

1. Unable to fetch kvstore status response: {}, content: {}

Check kvstore status, splunkd.log, and mongod.log.

2. kvstore current status is {}. Exiting now.

Check kvstore status, splunkd.log, and mongod.log.

3. Icons of {} version {} are already stored in kvstore collection. Skipping now and exiting.

You can ignore this message; I'm not sure why Splunk used exit(1) in this case. You can configure the ES Audit - Script Errors health check to ignore the script failure, but you risk ignoring valid save_image_and_icon_on_install.py issues as well. See <https://docs.splunk.com/Documentation/ES/latest/Admin/Troubleshootscripterrors#Customize_messages_ab...>. This specific save_image_and_icon_on_install.py use case is even covered in the documentation.

4. kvstore status is {}, exiting now.

This exits with code 0 and won't generate a system message; however, check kvstore status, splunkd.log, and mongod.log.

5. Failed to connect to splunkd.

You're unlike to see this, but if you do, check splunkd.log and python.log.

6. Failed to save icons to kvstore due to an error.

Check kvstore status, splunkd.log, and mongod.log.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...