Splunk Not Ingesting Data "could not convert string to float" or "an integer is required" Errors

Products

• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Workload

Issue/Introduction

Splunk has stopped ingesting Carbon Black Cloud (CBC) datasuch as Alerts or Audit Logsand the following errors are observed in the logs:

log_level=ERROR pid=<PID> tid=MainThread file="VMWModularInput.py" function="print_error" line_number="974" version="2.2.6" host=<Splunk_Host> sourcetype=vmware_app_for_splunk:error source=vmware:cbc:input:<Input_GUID>  error_message="could not convert string to float: ''" error_type="<class 'ValueError'>" error_arguments="could not convert string to float: ''" error_filename="VMWModularInput.py" error_line_number="404" input_guid="<Input_GUID>" input_name="<InputName>" 

log_level=ERROR pid=<PID> tid=MainThread file="VMWModularInput.py" function="print_error" line_number="974" version="2.2.6" host=<Splunk_Host> sourcetype=vmware_app_for_splunk:error source=vmware:cbc:input:<Input_GUID>  error_message="an integer is required (got type str)" error_type="<class 'TypeError'>" error_arguments="an integer is required (got type str)" error_filename="vmware_cbc_client.py" error_line_number="405" input_guid="<Input_GUID>" input_name="<InputName>"

Environment

• Carbon Black Cloud
• Splunk App

Cause

The Splunk application stores the timestamp of its last successful data fetch inside a .txt checkpoint file. If Splunk or the app encounters an unexpected error or interruption, this file can be left entirely blank or become corrupted. When the app runs its next collection cycle, it attempts to read this corrupted/blank file to determine where it last left off. Because there is no valid numerical timestamp to read, the error occurs.

Resolution

1. Access the backend terminal/CLI of your Splunk Heavy Forwarder or Data Collection Node where the app is installed.
2. Navigate to the Splunk modinputs directory where the checkpoint files are stored.
   • For Alert input errors, the path is typically: /opt/splunk/var/lib/splunk/modinputs/vmware-cbc-alerts
   • For Audit Log input errors, the path is typically: /opt/splunk/var/lib/splunk/modinputs/vmware-cbc-audit-logs
3. Locate the .txt checkpoint file associated with the failing <Input_GUID> noted in your error logs.
4. Open the file to verify it is completely blank or contains corrupted characters instead of a standard UNIX timestamp.
5. Stop the Splunk service.
6. Delete the corrupted .txt file (or move it out of the modinputs directory as a backup).
7. Restart the Splunk service.