How to troubleshoot error "Search process did not exit cleanly, exit_code=-1, description="exited with code -1"."?

[mrtolu6]

I'm getting the following error. How do I troubleshoot?

Search process did not exit cleanly, exit_code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.

[cameronjust]

I just discovered the same problem and it is related to knowledge bundles no replicating from the search head to the indexers correctly.

A short term fix is to apply this to the etc/system/local/distsearch.conf

[replicationSettings]

sendRcvTimeout = 300
allowDeltaUpload = false

Then restart the search head.

My issue occurred due to the delta's of the bundles not replicating so only part of the knowledge bundle made it up to the indexers.

You should look into the reasons why the knowledge bundles were not replicating correctly due to networking problems or an overly large lookup causing the bundle replication to timeout.

Once everything is back to normal you should change back allowDeltaUpload to the default of true.

[replicationSettings]

sendRcvTimeout = 300
allowDeltaUpload = true

Which should only upload changes to bundles.

[btran]

I had the same issues, and I edited $SPLUNK\etc\apps\metadata\local.meta.
I changed from users ownership to admin
restarted splunk, and it works.

[francisbebita]

This works for us.
Thanks @btran ... Cheers

[lycollicott]

I have this too, but I don't see anything useful in the job inspector and when I click the link to open search.log nothing happens. I can't even find search.log on my servers.

[btran]

I just got the same error. did you ever find out what happen to it? do you have a fix for it?

[lycollicott]

This has happened less frequently since we upgraded to 6.5.2, but it still happens once in a while.