Does the panel named Host Authentications Map say Populating... under the Source Hosts and Destination Hosts multi-select fields?
If that's the case, the search populating the list of hosts is running too long for some reason - try running that search on its own over a 7-day period:
| tstats prestats=true summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.app=win* by Authentication.src
| stats count by Authentication.src
It's the search that populates the multi-select fields. It expects Authentication data model to be accelerated.
The next InfoSec app update will include some minor changes to this dashboard panel but please share additional details like the Splunk version, whether the search above produces a list of machines/IPs and whether the rest of the reports on the dashboard show data. This way it will be easier to pinpoint what happens in your setup and potentially prevent this happening in the next app update.
