Splunk Search

search problem

aalaa
Path Finder

Hello ,

I'm getting the following error in the Search head. How do I troubleshoot?

Search process did not exit cleanly, exit_code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.

Any help please ?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Go to Settings -> Licensing and it should clearly tell you that you have either an expired/invalid license or too many license violations and give you some options on how to proceed.

0 Karma

arjunpkishore5
Motivator

Searches are typically blocked when you have license violations. Have you exceeded license usage by any chance?

0 Karma

to4kawa
Ultra Champion

what's your query?

0 Karma

aalaa
Path Finder

All the searchs are blocked !
in my distributed environment, when I execute a search index=_internal or any other search from the search head, I don't get any results back. When I log into an indexer directly and perform the same search, the expected results are returned. I can see from the "Indexes" pages that there are definitely events in the _internal index on each indexer, but I don't seem to be able to access them from the search head.

0 Karma

wmyersas
Builder

sounds like a permissions or license issue

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...