Installation

Is there a list of the different Splunk CLI exit codes and their meaning?

lweber
Path Finder

Hi

I know that the Splunk CLI does exit with different exit codes (4: invalid command, 22: communication error).
Is there a list of different exit codes and their meaning?

Tags (2)
0 Karma
1 Solution

Sebastian2
Path Finder

According to this 3 year old CLI source code, it's something like

# return codes from this script
ERR_NOERR        = 0
ERR_NUMARGS      = 1
ERR_UNKNOWN      = 2
ERR_AUTH         = 3
ERR_ARG          = 4
ERR_DOTSPLUNK    = 5
ERR_VERSION      = 6
ERR_PIPE         = 7
ERR_STOP         = 21
ERR_SPLUNKD_DOWN = 22
ERR_NO_ENDPOINT  = 23
ERR_INVALID_STATUS_CODE = 24
ERR_AUTH_TOKEN_XML = 25
ERR_REST          = 26
ERR_SPLUNKD       = 27
ERR_SUCCESS       = 28

Source: https://github.com/edo17/splunk/blob/master/lib/python2.7/site-packages/splunk/clilib/cli.py

How ever, I'm not sure if this is what you are actually looking for. I suppose in best case this is just out of date...

View solution in original post

zanb
Path Finder

Ok, so thanks to user "MuS" I was able to find the exit statuses under $SPLUNK_HOME/lib/python2.7/site-packages/splunk/clilib/cli.py and to confirm, these are the exit codes for the Splunk command line tool:

ERR_NOERR        = 0
ERR_NUMARGS      = 1
ERR_UNKNOWN      = 2
ERR_AUTH         = 3
ERR_ARG          = 4
ERR_DOTSPLUNK    = 5
ERR_VERSION      = 6
ERR_PIPE         = 7
ERR_STOP         = 21
ERR_SPLUNKD_DOWN = 22
ERR_NO_ENDPOINT  = 23
ERR_INVALID_STATUS_CODE = 24
ERR_AUTH_TOKEN_XML = 25
ERR_REST          = 26
ERR_SPLUNKD       = 27
ERR_SUCCESS       = 28

Every night, around 1AM, I'm seeing exit codes for different indexers (usually a different one every night) that exits with 8 (which isn't defined!?), 7 (there aren't any pipes being sent!?), 6 (all versions are the same), and now 5 (DOTSPLUNK?). Can anyone point me in a direction that would explain why the Splunk CLI would output these exit codes through a command ($SPLUNK_HOME/bin/splunk status) that runs every 5 minutes, but only throws these errors around 1AM?

I'm running the latest version of Splunk Enterprise on an array of different hosts in an isolated lab.

Thank you!

0 Karma

Sebastian2
Path Finder

According to this 3 year old CLI source code, it's something like

# return codes from this script
ERR_NOERR        = 0
ERR_NUMARGS      = 1
ERR_UNKNOWN      = 2
ERR_AUTH         = 3
ERR_ARG          = 4
ERR_DOTSPLUNK    = 5
ERR_VERSION      = 6
ERR_PIPE         = 7
ERR_STOP         = 21
ERR_SPLUNKD_DOWN = 22
ERR_NO_ENDPOINT  = 23
ERR_INVALID_STATUS_CODE = 24
ERR_AUTH_TOKEN_XML = 25
ERR_REST          = 26
ERR_SPLUNKD       = 27
ERR_SUCCESS       = 28

Source: https://github.com/edo17/splunk/blob/master/lib/python2.7/site-packages/splunk/clilib/cli.py

How ever, I'm not sure if this is what you are actually looking for. I suppose in best case this is just out of date...

zanb
Path Finder

FYI, the link you posted was removed due to a DMCA takedown.

0 Karma

MuS
SplunkTrust
SplunkTrust

Well anyone with Splunk installed can check their local cli.py in $SPLUNK_HOME/lib/python2.7/site-packages/splunk/clilib ...

cheers, MuS

0 Karma

rvany
Communicator

Thank you from my side. In a current installation this still could be found under $SPLUNK_HOME/lib/python2.7/site-packages/splunk/clilib/cli.py - so at least the code seems to be current.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...