Reporting
Highlighted

Scheduled report error -- Search process did not exit cleanly, exit_code=-1, description="exited with code -1"

New Member

When running the following manually there are no issues. But when this is scheduled the following error is noted and half the information is not present.

[subsearch]: [1spl-ind04-dc1] Search process did not exit cleanly, exitcode=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.
[subsearch]: [1spl-ind04-dc2] Search process did not exit cleanly, exit
code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.

|inputlookup idstoroles.csv | where like (rolename,"%External User%") | join type=left userid[search index=onelogin eventtypeid=5 |eval mytime=strftime(time, "%Y-%m-%d") |lookup idstoroles.csv userid
|stats distinctcount(mytime) as "total logins" by rolename,username,userid |where like(rolename, "%External User%")] | table username,username, firstname, lastname, user_id, "total logins" |outputlookup logins.csv

0 Karma
Highlighted

Re: Scheduled report error -- Search process did not exit cleanly, exit_code=-1, description="exited with code -1"

Motivator

@agreer,

can you please check first pipe symbol is present i.e., before inputlookup command in your scheduled search and report. sometime when do save as report option from search bar. pipe symbol will be missed.

0 Karma
Highlighted

Re: Scheduled report error -- Search process did not exit cleanly, exit_code=-1, description="exited with code -1"

New Member

The pipe is there. I have also seen other answers state this is due to permissions. I have had a super user create the same report with the same result.

0 Karma
Highlighted

Re: Scheduled report error -- Search process did not exit cleanly, exit_code=-1, description="exited with code -1"

SplunkTrust
SplunkTrust

Seems likely the subsearch is running out of space or time. There's an easy way to invert the search, though, so that won't happen.

Try running this version ... if it gets the same result, then use it instead, and add the outputlookup on the end.

index=onelogin event_type_id=5 
| eval mytime=strftime(_time, "%Y-%m-%d") 
| lookup idstoroles.csv user_id 
| stats distinct_count(mytime) as logcount by role_name, user_name, user_id 
| where like(role_name, "%External User%")
| append [    | inputlookup idstoroles.csv 
              | where like (role_name,"%External User%") 
              | table role_name, user_name, user_id
              | eval logcount=0
         ]
| stats sum(logcount) as "total logins" by role_name, user_name, user_id 

View solution in original post

0 Karma