In splunkd.log, why do I receive repeating error "ERROR KVStorageProvider - An error occurred during the last operation...Cannot do an empty bulk write"?

[bnorthway_splun]

ERROR KVStorageProvider - An error occurred during the last operation ('saveBatchData', domain: '11', code: '22'): Cannot do an empty bulk write

This error is repeated in splunkd.log. The search head cluster appears to be functional but I am concerned about the cause of this error.

[season88481]

I found if there is a lookup file located at $SPLUNK_HOME/splunk/etc/apps/DA-ESS-ThreatIntelligence/local/data/threat_intel, such error will pop-up.

Then I mv my local_ip_intel.csv file to local_ip_intel.bak. Error message seems stop showing up. Anyone could explain what happen here?

[bnorthway_splun · Accepted solution]

This error indicates that a POST request has an empty json body. Try this search to find the offending request:

index=_internal sourcetype=splunkd_access batch_save status=500

In my case, Enterprise Security threat lists were failing to download and causing this error.

[season88481]

Hi Bnorthway,

I think I have the exact same issue as yours. The POST is realated to DA-ESS-ThreatIntelligence.

And I also have ERROR message complaining some threat intelligence download has failed:
emerging_threats_ip_blocklist
iblocklist_tor
emerging_threats_ip_blocklist
iblocklist_tor

Many thanks