Splunk data source creation failure due to no query results

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

When adding a Splunk data source query via the Integration Wizard (IW) in Information Centric Analytics (ICA), the following error is displayed when attempting to save the query:

Your request failed. Click 'OK' to close this window or 'Refresh' to refresh the page.
Try again or contact the site administrator.
Status: 500
StatusText: Internal Server Error

Error: Supplied query returned no data. Table not created

Error ID: <n>

 

Environment

Release : 6.x

Component : Splunk Integration

Cause

The query returns no records that fall within the Schema Start and Schema End staging table date range specified in the Query Details.

Resolution

Modify the query to return records that fall within the Schema Start and Schema End staging table date range, modify the Schema Start and/or Schema End values, or remove the Schema Start and/or Schema End values.