Creating a Splunk Data source fails on the save with error "Supplied query returned no data. Table not created"
search cancel

Creating a Splunk Data source fails on the save with error "Supplied query returned no data. Table not created"

book

Article ID: 189657

calendar_today

Updated On:

Products

Information Centric Analytics Data Loss Prevention Core Package

Issue/Introduction

Creating a Splunk Data source fails on the save with error "Supplied query returned no data. Table not created"

Environment

Release :

Component :

Cause

The query was not able to return results.

Resolution

When creating a Data source for Splunk there needs to be data in the query results for the "Days to Retain:" and the staging table date range.
If either of those would not have data when run the table cannot be created.

Attachments