Splunk Search

How to troubleshoot error "Search process did not exit cleanly, exit_code=-1, description="exited with code -1"."?

mrtolu6
Path Finder

I'm getting the following error. How do I troubleshoot?

Search process did not exit cleanly, exit_code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.
0 Karma

cameronjust
Path Finder

I just discovered the same problem and it is related to knowledge bundles no replicating from the search head to the indexers correctly.

A short term fix is to apply this to the etc/system/local/distsearch.conf

[replicationSettings]

sendRcvTimeout = 300
allowDeltaUpload = false

Then restart the search head.

My issue occurred due to the delta's of the bundles not replicating so only part of the knowledge bundle made it up to the indexers.

You should look into the reasons why the knowledge bundles were not replicating correctly due to networking problems or an overly large lookup causing the bundle replication to timeout.

Once everything is back to normal you should change back allowDeltaUpload to the default of true.

[replicationSettings]

sendRcvTimeout = 300
allowDeltaUpload = true

Which should only upload changes to bundles.

0 Karma

btran
Explorer

I had the same issues, and I edited $SPLUNK\etc\apps\metadata\local.meta.
I changed from users ownership to admin
restarted splunk, and it works.

francisbebita
Explorer

This works for us.
Thanks @btran ... Cheers

0 Karma

lycollicott
Motivator

I have this too, but I don't see anything useful in the job inspector and when I click the link to open search.log nothing happens. I can't even find search.log on my servers.

0 Karma

btran
Explorer

I just got the same error. did you ever find out what happen to it? do you have a fix for it?

0 Karma

lycollicott
Motivator

This has happened less frequently since we upgraded to 6.5.2, but it still happens once in a while.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...