Creating a Splunk Data source fails on the save with error "Supplied query returned no data. Table not created"
book
Article ID: 189657
calendar_today
Updated On:
Products
Information Centric AnalyticsData Loss Prevention Core Package
Issue/Introduction
Creating a Splunk Data source fails on the save with error "Supplied query returned no data. Table not created"
Environment
Release :
Component :
Cause
The query was not able to return results.
Resolution
When creating a Data source for Splunk there needs to be data in the query results for the "Days to Retain:" and the staging table date range. If either of those would not have data when run the table cannot be created.