Splunk Search

How to troubleshoot error "Search process did not exit cleanly, exit_code=-1, description="exited with code -1"."?

mrtolu6
Path Finder

I'm getting the following error. How do I troubleshoot?

Search process did not exit cleanly, exit_code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.
0 Karma

cameronjust
Path Finder

I just discovered the same problem and it is related to knowledge bundles no replicating from the search head to the indexers correctly.

A short term fix is to apply this to the etc/system/local/distsearch.conf

[replicationSettings]

sendRcvTimeout = 300
allowDeltaUpload = false

Then restart the search head.

My issue occurred due to the delta's of the bundles not replicating so only part of the knowledge bundle made it up to the indexers.

You should look into the reasons why the knowledge bundles were not replicating correctly due to networking problems or an overly large lookup causing the bundle replication to timeout.

Once everything is back to normal you should change back allowDeltaUpload to the default of true.

[replicationSettings]

sendRcvTimeout = 300
allowDeltaUpload = true

Which should only upload changes to bundles.

0 Karma

btran
Explorer

I had the same issues, and I edited $SPLUNK\etc\apps\metadata\local.meta.
I changed from users ownership to admin
restarted splunk, and it works.

francisbebita
Explorer

This works for us.
Thanks @btran ... Cheers

0 Karma

lycollicott
Motivator

I have this too, but I don't see anything useful in the job inspector and when I click the link to open search.log nothing happens. I can't even find search.log on my servers.

0 Karma

btran
Explorer

I just got the same error. did you ever find out what happen to it? do you have a fix for it?

0 Karma

lycollicott
Motivator

This has happened less frequently since we upgraded to 6.5.2, but it still happens once in a while.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...