Getting Data In

What are the possible return values from the Splunk init script?

JHill
Explorer

I have a Splunk forwarder instance that appears to be returning a value of 2 during start up.

I am curious as to what the possible return values are for the init script and what they mean.

Tags (1)
1 Solution

jrodman
Splunk Employee
Splunk Employee

I assume you mean the script which ends up as /etc/init.d/splunk or similar?
This thing invokes the launcher (bin/splunk) and passes its return values along.

The values don't appear to be that useful right now.

  • 0 obviously is success.
  • 4 seems to suggest permissions problems
  • 8 refers to environment problems

The new 4.1 command line work incorporates this table:

#define EXIT_NO_ARGS 8
#define EXIT_CMD_IGNORE 9
#define EXIT_FAILURE_USAGE 10
#define EXIT_FAILURE_DEPRECATED_CMD 11
#define EXIT_FAILURE_PARSE_CMD_LINE 12
#define EXIT_FAILURE_NO_HELP_EXISTS 14
#define EXIT_FAILURE_NO_DISPLAY_FUNC 15
#define EXIT_FAILURE_NO_CMD_EXISTS 16
#define EXIT_FAILURE_NOT_IMPLEMENTED 18
#define EXIT_FAILURE_NO_OBJ_EXISTS 19
#define EXIT_FAILURE_FGETS_READ 20
#define EXIT_FAILURE_REQD_ARG_MISSING 21
#define EXIT_FAILURE_REST_CALL 22
#define EXIT_FAILURE_DISPLAY_FUNC_ERR 23
#define EXIT_FAILURE_LOGIN 24
#define EXIT_FAILURE_URI_FORMAT 25

However we incorporate third party libraries. For example in some circumstances openssl (how the splunk executable communicates with splunkd) will exit(2) on its own. Compiling a complete list right now is not likely to be useful.

Instead I would suggest:

  1. Try launching splunk yourself, ideally with the same user that the script does, or run the script yourself (sh -x -v /etc/init.d/splunk start) to see what happens.
  2. Review $SPLUNK_HOME/var/log/splunk/splunkd_stderr.log and splunkd.log

View solution in original post

jrodman
Splunk Employee
Splunk Employee

I assume you mean the script which ends up as /etc/init.d/splunk or similar?
This thing invokes the launcher (bin/splunk) and passes its return values along.

The values don't appear to be that useful right now.

  • 0 obviously is success.
  • 4 seems to suggest permissions problems
  • 8 refers to environment problems

The new 4.1 command line work incorporates this table:

#define EXIT_NO_ARGS 8
#define EXIT_CMD_IGNORE 9
#define EXIT_FAILURE_USAGE 10
#define EXIT_FAILURE_DEPRECATED_CMD 11
#define EXIT_FAILURE_PARSE_CMD_LINE 12
#define EXIT_FAILURE_NO_HELP_EXISTS 14
#define EXIT_FAILURE_NO_DISPLAY_FUNC 15
#define EXIT_FAILURE_NO_CMD_EXISTS 16
#define EXIT_FAILURE_NOT_IMPLEMENTED 18
#define EXIT_FAILURE_NO_OBJ_EXISTS 19
#define EXIT_FAILURE_FGETS_READ 20
#define EXIT_FAILURE_REQD_ARG_MISSING 21
#define EXIT_FAILURE_REST_CALL 22
#define EXIT_FAILURE_DISPLAY_FUNC_ERR 23
#define EXIT_FAILURE_LOGIN 24
#define EXIT_FAILURE_URI_FORMAT 25

However we incorporate third party libraries. For example in some circumstances openssl (how the splunk executable communicates with splunkd) will exit(2) on its own. Compiling a complete list right now is not likely to be useful.

Instead I would suggest:

  1. Try launching splunk yourself, ideally with the same user that the script does, or run the script yourself (sh -x -v /etc/init.d/splunk start) to see what happens.
  2. Review $SPLUNK_HOME/var/log/splunk/splunkd_stderr.log and splunkd.log
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...