search problem

[aalaa]

Hello ,

I'm getting the following error in the Search head. How do I troubleshoot?

Search process did not exit cleanly, exit_code=-1, description="exited with code -1". Please look in search.log for this peer in the Job Inspector for more info.

Any help please ?

[woodcock]

Go to Settings -> Licensing and it should clearly tell you that you have either an expired/invalid license or too many license violations and give you some options on how to proceed.

[arjunpkishore5]

Searches are typically blocked when you have license violations. Have you exceeded license usage by any chance?

[to4kawa]

what's your query?

[aalaa]

All the searchs are blocked !
in my distributed environment, when I execute a search index=_internal or any other search from the search head, I don't get any results back. When I log into an indexer directly and perform the same search, the expected results are returned. I can see from the "Indexes" pages that there are definitely events in the _internal index on each indexer, but I don't seem to be able to access them from the search head.

[wmyersas]

sounds like a permissions or license issue

[to4kawa]

What Splunk software logs about itself

How did you check it?