Splunk Search

Why do we get the exited with code 255 errors?

ddrillic
Ultra Champion

When we search (on stage) using index = <index name>, no results come up and we get the following -

2 errors occurred while the search was executing. Therefore, search results might be incomplete. Hide errors.
    [<indexer1>] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
    [<indexer2>] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.

What can it be?

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I noticed you said (on stage). Does this mean you are searching production from staging? Do all the apps exist in both locations?

For example, you have a staging app called Stage_Search. You are in this app context, and try to do a distributed search to production. If Stage_Search does not exist as an app on the production indexers, it might throw a 255. Create the app on the indexers, doesn't need anything in it, just a stub is fine.

splunk create app Stage_Search

Do that on all the indexers (or use CM to push if in a cluster) and try your search again.

0 Karma

ddrillic
Ultra Champion

As far as I can recall, we ran out of disk space on the server.

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...