Why am I receiving "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" error with my current search?

[lksridhar]

Hi Folks,

While executing the below command on Search and Reporting app, we are getting below error. could you please any one check and provide me resolution to fix the issue?

Error:

Search process did not exit cleanly, exit_code=255, description="exited with code 255"

search:

sourcetype="Cisco" | iplocation src_ip | geostats count by src_ip

[muebel]

Hi Iksridhar, I expect you'll find more info in the search job inspector. More info on accessing that here : https://docs.splunk.com/Documentation/Splunk/6.5.2/Search/ViewsearchjobpropertieswiththeJobInspector

You should find additional debug information there. If you don't get this error on all searches, my guess is that it has something to do with either the iplocation or geostats command. In particular, I'd take another look at the geostats documentation to make sure you are passing any parameters that might help the command : https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Geostats

Please let me know if this helps!

[lksridhar]

muebel, thanks for the info, i'm getting the above error while executing the iplocation or geostats command.

[DalJeanis]

try this -

sourcetype="Cisco" src_ip=* | head 10 | iplocation src_ip 

if no error, try this -

sourcetype="Cisco" src_ip=*| iplocation src_ip 

if no error, try this

sourcetype="Cisco" src_ip=* | iplocation src_ip | geostats count by src_ip

[lksridhar]

the above three command is not working on my search and i am not able to find any error and warning message on search log.

[muebel]

anything of note in the job inspector results?