Splunk Search

Getting errors for every search I run

usha_nittala
New Member

Hi All,

I am getting below error for every search I am rinning for Summary indexing.

Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.

This error is coming for all the indexers.

I have read couple of splunk annwers and then removed huge csv's from lookups directory by blacklisting them from distsearch.conf, but still my searches are failing.

I am not able to do this :
index=summary

It throws error.
I checked the size of the bundles on search heads and indexers and the size of the bundle is same.
Then why am I getting error while searching.

Thanks ,
Usha

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

Open the job inspector and look in search.log for errors and post any you find there.

255 is an exit code from a python function (probably os.subprocess) and is probably related to file permissions on the disk.

Is the splunkd process running as the correct user? Did it run as root once and now it's running as less priveleged user now?

You may need to recursively chown the Splunk directory 'chown -Rf splunkuser:splunkgroup /path/to/splunk' after stopping Splunkd and insuring it will start as the correct user next time.

This is linux right?

0 Karma

usha_nittala
New Member

Splunk version is 6.1.4

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...