Dashboards & Visualizations

SSO with SAML in distributed environment : Why is data retrieved and seen in inline search, but not when in a dashboard?

New Member


We are in a distributed configuration. We want to add SSO to Splunk Active Directory Federation Services (ADFS). We have only configured SSO with ADFS on the search head. For the authentication it works fine (with a little bit of works). But we have a strange behavior with dashboard :
- when running the inline search from a panel, no issue : datas are retrieved and displayed correctly
- when running the search from the dashboard : datas are not displayed, we get a no result found

I've tried to add a new panel on an existing dashboard, same issue. On a new dashboard (private or shared), same issue. I think this is related to a role permission, but don't know how to troubleshoot this.

Does anyone had already encountered this behavior, do we need to set up SSO on all node of the Splunk infrastructure (search head and indexer)?

Thanks for your help.

0 Karma


You do not need to setup SSO on the indexer. It's only required for the search head.

If you hover your mouse over the panel a toolbar shows up at the bottom. One of the icons is "open in search", click on this and confirm you do indeed get results. Then click on the "i" icon (inspect). This will open up the Search Job Inspector window. There is a link for "search.log" which you can browse, it will state the reason for why no results are found.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...