Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise
- :
- Re: MLTK error with non-zero error code 1.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I resolve MLTK error with non-zero error code 1?
Hi everyone,
I installed Machine Learning Splunk Tools for testing from Splunkbase, and after trying run ml I got error. What can I do to resolve it?
Error in 'fit' command: External search command exited unexpectedly with non-zero error code 1.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Take a look in the search.log (accessed via the job inspector). That error usually happens when something happens in a python scripted search command and that log usually contains the reason for failure.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@twesty Searches are defaults from Showcase examples where data loading from CSV. I can't understand what wrong because I have not issues with search running or reading csv file. In the _internal index, I have not errors too. Only message about non-zero error code 1 in MLTK application.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Solution is in this thread
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rendie have you been able to resolve this problem? I'm stuck with the same issue. I have tried re-installing the PSC app, but no success.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did not solve this problem. I reinstalled Splunk, this action helped me. The root cause of the issue I don't know.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think it's likely to be due to a missing input or something. If the UI isnt particularly clear as to whats missing then I would raise a support ticket as a bug. however I would check in the search.log first to see what the error is.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
