Splunk Search

Why does my search produce error "Search process did not exit cleanly, exit_code=254" in my search head clustering environment?

rbal_splunk
Splunk Employee
Splunk Employee

What could cause this error? I have a distributed search environment with a Search Head having multiple indexers, and a Search Head Cluster with multiple indexers.

1 Solution

rbal_splunk
Splunk Employee
Splunk Employee

If you see this often, then it should be investigated as well.
It might be something temporary or a lingering issue.

This message pops up when there is some issue with the search on one of the indexers.
More info should be in the remote_search.log for the indexer.

It can happen if the search dir was not found on the indexer, or
if there was some problem with bundle distribution and some knowledge objects are missing for the search on the indexer.

I also saw that when permissions were not the same on the SH and indexers, so the search on the indexer had some errors.

View solution in original post

rbal_splunk
Splunk Employee
Splunk Employee

If you see this often, then it should be investigated as well.
It might be something temporary or a lingering issue.

This message pops up when there is some issue with the search on one of the indexers.
More info should be in the remote_search.log for the indexer.

It can happen if the search dir was not found on the indexer, or
if there was some problem with bundle distribution and some knowledge objects are missing for the search on the indexer.

I also saw that when permissions were not the same on the SH and indexers, so the search on the indexer had some errors.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...