Splunk Search

Why am I receiving "Search process did not exit cleanly, exit_code=255, description="exited with code 255"" error with my current search?

lksridhar
Explorer

Hi Folks,

While executing the below command on Search and Reporting app, we are getting below error. could you please any one check and provide me resolution to fix the issue?

Error:

Search process did not exit cleanly, exit_code=255, description="exited with code 255"

search:

sourcetype="Cisco" | iplocation src_ip | geostats count by src_ip
Tags (1)
0 Karma

muebel
SplunkTrust
SplunkTrust

Hi Iksridhar, I expect you'll find more info in the search job inspector. More info on accessing that here : https://docs.splunk.com/Documentation/Splunk/6.5.2/Search/ViewsearchjobpropertieswiththeJobInspector

You should find additional debug information there. If you don't get this error on all searches, my guess is that it has something to do with either the iplocation or geostats command. In particular, I'd take another look at the geostats documentation to make sure you are passing any parameters that might help the command : https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Geostats

Please let me know if this helps!

0 Karma

lksridhar
Explorer

muebel, thanks for the info, i'm getting the above error while executing the iplocation or geostats command.

0 Karma

DalJeanis
Legend

try this -

sourcetype="Cisco" src_ip=* | head 10 | iplocation src_ip 

if no error, try this -

sourcetype="Cisco" src_ip=*| iplocation src_ip 

if no error, try this

sourcetype="Cisco" src_ip=* | iplocation src_ip | geostats count by src_ip
0 Karma

lksridhar
Explorer

the above three command is not working on my search and i am not able to find any error and warning message on search log.

0 Karma

muebel
SplunkTrust
SplunkTrust

anything of note in the job inspector results?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...