Installation

Is there a list of the different Splunk CLI exit codes and their meaning?

lweber
Path Finder

Hi

I know that the Splunk CLI does exit with different exit codes (4: invalid command, 22: communication error).
Is there a list of different exit codes and their meaning?

Tags (2)
0 Karma
1 Solution

Sebastian2
Path Finder

According to this 3 year old CLI source code, it's something like

# return codes from this script
ERR_NOERR        = 0
ERR_NUMARGS      = 1
ERR_UNKNOWN      = 2
ERR_AUTH         = 3
ERR_ARG          = 4
ERR_DOTSPLUNK    = 5
ERR_VERSION      = 6
ERR_PIPE         = 7
ERR_STOP         = 21
ERR_SPLUNKD_DOWN = 22
ERR_NO_ENDPOINT  = 23
ERR_INVALID_STATUS_CODE = 24
ERR_AUTH_TOKEN_XML = 25
ERR_REST          = 26
ERR_SPLUNKD       = 27
ERR_SUCCESS       = 28

Source: https://github.com/edo17/splunk/blob/master/lib/python2.7/site-packages/splunk/clilib/cli.py

How ever, I'm not sure if this is what you are actually looking for. I suppose in best case this is just out of date...

View solution in original post

zanb
Path Finder

Ok, so thanks to user "MuS" I was able to find the exit statuses under $SPLUNK_HOME/lib/python2.7/site-packages/splunk/clilib/cli.py and to confirm, these are the exit codes for the Splunk command line tool:

ERR_NOERR        = 0
ERR_NUMARGS      = 1
ERR_UNKNOWN      = 2
ERR_AUTH         = 3
ERR_ARG          = 4
ERR_DOTSPLUNK    = 5
ERR_VERSION      = 6
ERR_PIPE         = 7
ERR_STOP         = 21
ERR_SPLUNKD_DOWN = 22
ERR_NO_ENDPOINT  = 23
ERR_INVALID_STATUS_CODE = 24
ERR_AUTH_TOKEN_XML = 25
ERR_REST          = 26
ERR_SPLUNKD       = 27
ERR_SUCCESS       = 28

Every night, around 1AM, I'm seeing exit codes for different indexers (usually a different one every night) that exits with 8 (which isn't defined!?), 7 (there aren't any pipes being sent!?), 6 (all versions are the same), and now 5 (DOTSPLUNK?). Can anyone point me in a direction that would explain why the Splunk CLI would output these exit codes through a command ($SPLUNK_HOME/bin/splunk status) that runs every 5 minutes, but only throws these errors around 1AM?

I'm running the latest version of Splunk Enterprise on an array of different hosts in an isolated lab.

Thank you!

0 Karma

Sebastian2
Path Finder

According to this 3 year old CLI source code, it's something like

# return codes from this script
ERR_NOERR        = 0
ERR_NUMARGS      = 1
ERR_UNKNOWN      = 2
ERR_AUTH         = 3
ERR_ARG          = 4
ERR_DOTSPLUNK    = 5
ERR_VERSION      = 6
ERR_PIPE         = 7
ERR_STOP         = 21
ERR_SPLUNKD_DOWN = 22
ERR_NO_ENDPOINT  = 23
ERR_INVALID_STATUS_CODE = 24
ERR_AUTH_TOKEN_XML = 25
ERR_REST          = 26
ERR_SPLUNKD       = 27
ERR_SUCCESS       = 28

Source: https://github.com/edo17/splunk/blob/master/lib/python2.7/site-packages/splunk/clilib/cli.py

How ever, I'm not sure if this is what you are actually looking for. I suppose in best case this is just out of date...

zanb
Path Finder

FYI, the link you posted was removed due to a DMCA takedown.

0 Karma

MuS
Legend

Well anyone with Splunk installed can check their local cli.py in $SPLUNK_HOME/lib/python2.7/site-packages/splunk/clilib ...

cheers, MuS

0 Karma

rvany
Communicator

Thank you from my side. In a current installation this still could be found under $SPLUNK_HOME/lib/python2.7/site-packages/splunk/clilib/cli.py - so at least the code seems to be current.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...