Splunk Enterprise Security

Why did a script exited abnormally with exit status 1?

kellybee
Loves-to-Learn Lots

Hi i am kinda new to Splunk and I'm having this trouble 
`A script exited abnormally with exit status: 1" input=".$SPLUNK_HOME/etc/apps/splunk-dashboard-studio/bin/save_image_and_icon_on_install.py"`

I have 1 Master sever(Cluster Master, SHC Deployer, License Master), 3 search heads(clustered) 3 indexers(clustered) 1 heavy forwarder

i've run below command that I found on a web

```

| rest /services/admin/inputstatus/ModularInputs:modular%20input%20commands splunk_server=local count=0 
| append [| rest /services/admin/inputstatus/ExecProcessor:exec%20commands splunk_server=local count=0] 
| fields inputs*
| transpose
| rex field=column "inputs(?<script>\S+)(?:\s\((?<stanza>[^\(]+)\))?\.(?<key>(exit status description)|(time closed)|(time opened))"
| eval value=coalesce('row 1', 'row 2'), stanza=coalesce(stanza, "default"), started=if(key=="time opened", value, started), stopped=if(key=="time closed", value, stopped)
| rex field=value "exited\s+with\s+code\s+(?<exit_status>\d+)"
| stats first(started) as started, first(stopped) as stopped, first(exit_status) as exit_status by script, stanza
| eval errmsg=case(exit_status=="0", null(), isnotnull(exit_status), "A script exited abnormally with exit status: "+exit_status, isnull(started) or isnotnull(stopped), "A script is in an unknown state"), ignore=if(`script_error_msg_ignore`, 1, 0)

```

and I got this result 

kellybee_0-1694392209177.png

exit_status 1 and 114 how do i get rid of this errors? 

Thank you in advance.

Labels (2)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as those are Splunk's own scripts and they should fix those by themselves, I said that the easiest way to get rid of those is just add e.g. this to your SPL

| rex field=value "exited\s+with\s+code\s+(?<exit_status>\d+)" 

``` Add this one line ```
| where (script != ".$SPLUNK_HOME/etc/apps/splunk-dashboard-studio/bin/save_image_and_icon_on_install.py" AND script != ".$SPLUNK_HOME/etc/apps/splunk_instrumentation/bin/instrumentation.py")

| stats first(started) as started, first(stopped) as stopped, first(exit_status) as exit_status by script, stanza 

r. Ismo 

0 Karma

kellybee
Loves-to-Learn Lots

the error message appear in the message tab with yellow warning sign. and this just gone like I did nothing.  thanks for your answer. I'll try yours if I have this again. 
Thank you.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...