Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Platform
- :
- Splunk Enterprise
- :
- Re: MLTK error with non-zero error code 1.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do I resolve MLTK error with non-zero error code 1?
Hi everyone,
I installed Machine Learning Splunk Tools for testing from Splunkbase, and after trying run ml I got error. What can I do to resolve it?
Error in 'fit' command: External search command exited unexpectedly with non-zero error code 1.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Take a look in the search.log (accessed via the job inspector). That error usually happens when something happens in a python scripted search command and that log usually contains the reason for failure.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@twesty Searches are defaults from Showcase examples where data loading from CSV. I can't understand what wrong because I have not issues with search running or reading csv file. In the _internal index, I have not errors too. Only message about non-zero error code 1 in MLTK application.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Solution is in this thread
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@rendie have you been able to resolve this problem? I'm stuck with the same issue. I have tried re-installing the PSC app, but no success.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did not solve this problem. I reinstalled Splunk, this action helped me. The root cause of the issue I don't know.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think it's likely to be due to a missing input or something. If the UI isnt particularly clear as to whats missing then I would raise a support ticket as a bug. however I would check in the search.log first to see what the error is.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
