No data imported from new data source integration

Products

• Information Centric Analytics

Issue/Introduction

After adding a new data source, data source query, and import rule mapping for a new integration using the Integration Wizard (IW), the expected data are not visible in the Risk Fabric console. The nightly RiskFabric Processing job is completing successfully without errors and a query of the data source's staging table shows data have been imported from the data source.

Environment

Version : 6.x

Component : Integration Wizard

Cause

The import rule mapping's Risk Fabric Processing Watermark has been manually set with a value of a data type that differs from the data type set in the data source query's watermark column.

For example, you have integrated a Splunk data source and are using the column RowID (int data type) as the data source query's watermark column; however, you have set the import rule mapping's Risk Fabric Processing Watermark value as 2025-02-28T00:00:00.000 (datetime data type).

Resolution

Per the Symantec ICA Integration and Solution Accelerator Guides, the import rule mapping's Risk Fabric Processing Watermark field should be left blank at the time the import rule mapping is created. The watermark value will automatically populate and increment each time processing completes. If you have manually set or modified the watermark, either clear it and allow the system to reset the watermark value, or modify the value to match the data type of the column used for the data source query watermark.