All Apps and Add-ons

Error code 255 on Sentiment App

efullman
Path Finder

Hi,

I'm getting this error:

External search command 'sentiment' returned error code 255. Script output = "ERROR "Search results do not have the specified text field: ""text""" "

I'm using a field called "text" from my twitter feed that holds the tweet text. Often the tweets don't have a text field, I have tried a couple ways to interrogate for a field, but it seems like this should catch a tweet like a Delete that has no text.

text=* AND text!="" $searchTerms$ | sentiment twitter text | eval sentiment=if(sentiment==1.0, "Positive", "Negative") | rename sentiment as Sentiment | chart count by Sentiment

Tags (1)
0 Karma

jbrodsky_splunk
Splunk Employee
Splunk Employee

This has been seen on distributed environments. The fix is to go into commands.conf, and set "local = true" for each of the four custom commands. Copy commands.conf to local before you do this. See below.

[sentiment]
filename = sentiment.py
retainsevents = true
streaming = true
local = true **<-- add this here**
supports_getinfo = false
run_in_preview = true
enableheader = false
#changes_colorder = true
#overrides_timeorder = false
supports_rawargs = true

Do the same for language, tokens, and heat commands in the same file. A restart should not be required.

0 Karma

ccsfdave
Builder

This didn't seem to work in fixing my error. Did I spread it too widely? I sent it out via DS to my SH and Indexers.

I added the local = true throughout the four stanzas of the commands.conf.

Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...