Splunk Search

Why do we get the exited with code 255 errors?

ddrillic
Ultra Champion

When we search (on stage) using index = <index name>, no results come up and we get the following -

2 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.
    [<indexer1>] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
    [<indexer2>] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.

What can it be?

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I noticed you said (on stage). Does this mean you are searching production from staging? Do all the apps exist in both locations?

For example, you have a staging app called Stage_Search. You are in this app context, and try to do a distributed search to production. If Stage_Search does not exist as an app on the production indexers, it might throw a 255. Create the app on the indexers, doesn't need anything in it, just a stub is fine.

splunk create app Stage_Search

Do that on all the indexers (or use CM to push if in a cluster) and try your search again.

0 Karma

ddrillic
Ultra Champion

As far as I can recall, we ran out of disk space on the server.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...