Creating a Splunk Data source fails on the save with error "Supplied query returned no data. Table not created"

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

Creating a Splunk Data source fails on the save with error "Supplied query returned no data. Table not created"

Environment

Release :

Component :

Cause

The query was not able to return results.

Resolution

When creating a Data source for Splunk there needs to be data in the query results for the "Days to Retain:" and the staging table date range.
If either of those would not have data when run the table cannot be created.