Getting Data In

Health Check: msg="A script exited abnormally with exit status: 1 issue in the ES SH.

AL3Z
Builder

Hi ,

How we can fix this issue in ES SH "Health Check: msg="A script exited abnormally with exit status: 1" input=".$SPLUNK_HOME/etc/apps/splunk-dashboard-studio/bin/save_image_and_icon_on_install.py" stanza="default"

Thanks..

Labels (1)
0 Karma

tscroggins
Influencer

Hi @AL3Z,

The cause depends on the output of save_image_and_icon_on_install.py.

Try this search:

index=_internal sourcetype=splunkd save_image_and_icon_on_install.py

Possible outcomes in Splunk Enterprise 9.1.1 / Dashboard Studio 1.11.6:

1. Unable to fetch kvstore status response: {}, content: {}

Check kvstore status, splunkd.log, and mongod.log.

2. kvstore current status is {}. Exiting now.

Check kvstore status, splunkd.log, and mongod.log.

3. Icons of {} version {} are already stored in kvstore collection. Skipping now and exiting.

You can ignore this message; I'm not sure why Splunk used exit(1) in this case. You can configure the ES Audit - Script Errors health check to ignore the script failure, but you risk ignoring valid save_image_and_icon_on_install.py issues as well. See <https://docs.splunk.com/Documentation/ES/latest/Admin/Troubleshootscripterrors#Customize_messages_ab...>. This specific save_image_and_icon_on_install.py use case is even covered in the documentation.

4. kvstore status is {}, exiting now.

This exits with code 0 and won't generate a system message; however, check kvstore status, splunkd.log, and mongod.log.

5. Failed to connect to splunkd.

You're unlike to see this, but if you do, check splunkd.log and python.log.

6. Failed to save icons to kvstore due to an error.

Check kvstore status, splunkd.log, and mongod.log.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...