topic Re: In splunkd.log, why do I receive repeating error "ERROR KVStorageProvider - An error occurred during the last operation...Cannot do an empty bulk write"? in Getting Data In

In splunkd.log, why do I receive repeating error "ERROR KVStorageProvider - An error occurred during the last operation...Cannot do an empty bulk write"?

bnorthway_splun — Fri, 10 Mar 2017 19:53:34 GMT

ERROR KVStorageProvider - An error occurred during the last operation ('saveBatchData', domain: '11', code: '22'): Cannot do an empty bulk write

This error is repeated in splunkd.log. The search head cluster appears to be functional but I am concerned about the cause of this error.

Re: In splunkd.log, why do I receive repeating error "ERROR KVStorageProvider - An error occurred during the last operation...Cannot do an empty bulk write"?

bnorthway_splun — Tue, 29 Sep 2020 13:10:14 GMT

This error indicates that a POST request has an empty json body. Try this search to find the offending request:

index=_internal sourcetype=splunkd_access batch_save status=500

In my case, Enterprise Security threat lists were failing to download and causing this error.

Re: In splunkd.log, why do I receive repeating error "ERROR KVStorageProvider - An error occurred during the last operation...Cannot do an empty bulk write"?

season88481 — Tue, 29 Sep 2020 13:10:58 GMT

Hi Bnorthway,

I think I have the exact same issue as yours. The POST is realated to DA-ESS-ThreatIntelligence.

And I also have ERROR message complaining some threat intelligence download has failed:
emerging_threats_ip_blocklist
iblocklist_tor
emerging_threats_ip_blocklist
iblocklist_tor

Many thanks

Re: In splunkd.log, why do I receive repeating error "ERROR KVStorageProvider - An error occurred during the last operation...Cannot do an empty bulk write"?

season88481 — Tue, 29 Sep 2020 14:19:20 GMT

I found if there is a lookup file located at $SPLUNK_HOME/splunk/etc/apps/DA-ESS-ThreatIntelligence/local/data/threat_intel, such error will pop-up.

Then I mv my local_ip_intel.csv file to local_ip_intel.bak. Error message seems stop showing up. Anyone could explain what happen here?