Dashboards & Visualizations

SSO with SAML in distributed environment : Why is data retrieved and seen in inline search, but not when in a dashboard?

gdausque
New Member

Hello,

We are in a distributed configuration. We want to add SSO to Splunk Active Directory Federation Services (ADFS). We have only configured SSO with ADFS on the search head. For the authentication it works fine (with a little bit of works). But we have a strange behavior with dashboard :
- when running the inline search from a panel, no issue : datas are retrieved and displayed correctly
- when running the search from the dashboard : datas are not displayed, we get a no result found

I've tried to add a new panel on an existing dashboard, same issue. On a new dashboard (private or shared), same issue. I think this is related to a role permission, but don't know how to troubleshoot this.

Does anyone had already encountered this behavior, do we need to set up SSO on all node of the Splunk infrastructure (search head and indexer)?

Thanks for your help.

0 Karma

suarezry
Builder

You do not need to setup SSO on the indexer. It's only required for the search head.

If you hover your mouse over the panel a toolbar shows up at the bottom. One of the icons is "open in search", click on this and confirm you do indeed get results. Then click on the "i" icon (inspect). This will open up the Search Job Inspector window. There is a link for "search.log" which you can browse, it will state the reason for why no results are found.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...