Splunk Search

How to resolve Error in 'similarity' command: External search command exited unexpectedly with non-zero error code 9?

soheil115
Engager

I use nlp-text-analytics app for similarity between two strings but I get above error

error1.jpg

 

when I run lines 1, 2, and 3, it gives a result of about 14,973,764 (3814*3926)

error2.jpg

 

It is interesting that if I reduce the data, for example, the output of the third line is  13.348.400 (3400* 3926 )  , it does not give an error and the result of the fourth line is returned.

error3.jpg

 

This means that the similarity command has problems with data above 13.5 million

my splunk is 8.2
nlp-text-analytics 1.1.3
python_upgrade_readiness_app  4.0.2 
 
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The similarity command is not standard.  What app did it come with?

Have you looked at the search log to see if there are more details that might explain the cause of the error?  Find the search log by opening the Job Inspector then scrolling down to the bottom and clicking on the "search.log" link.

Based on the error code, I suspect you're running into a limitation, probably memory, but the search log should have that information.

Also check /var/log/messages for OOM killer messages.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...