It looks like you are doing everything correctly. Do you have any blocking elements in your environment like a proxy or firewall?  Also, do you find any internal logs that may contain more clues as to why the authentication fails? e.g.  index=_internal authentication failed (and any events that occur around the events that explicitly say "authentication" or "failed")

Does this combined query produce the desired results? |mstats sum(transaction) as Total sum(success) as Success where index=metric-index transaction IN(transaction1, transaction2, transaction3) by service transaction |eval SuccessPerct=round(((Success/Total)*100),2) |xyseries service transaction Total Success SuccessPerct |table service "Success: transaction1" "SuccessPerct: transaction1" "SuccessPerct: transaction2" "Total: transaction2" "Success: transaction2" |join service [|mstats sum(error-count) as Error where index=metric-index by service errortype |append [|search index=app-index sourcetype=appl-logs (TERM(POST) OR TERM(GET) OR TERM(DELETE) OR TERM(PATCH)) OR errorNumber!=0 appls=et |lookup app-error.csv code as errorNumber output type as errortype |stats count as app.error count by appls errortype |rename appls as service error-count as Error] |xyseries service errortype Error |rename wvv as WVVErrors xxf as nonerrors] |addtotals "Success: transaction1" WVVErrors nonerrors fieldname="Total: transaction1" |eval sort_service=case(service="serv1",1,service="serv2",2,service="serv3",3,service="serv4",4,service="serv5",5,service="serv6",6,service="serv7",7,service="serv8",8,service="serv9",9,service="serv10",10) |sort + sort_service |table service "Success: transaction1" "SuccessPerct: transaction2" WVVErrors nonerrors |fillnull value=0 | append [|mstats sum(error-count) as Error where index=metric-index by service errorNumber errortype] | stats values(*) as * by service

Hi, Thank you for the prompt response. Trellis layout can be one of the options. However, for example, If I click on DB, then it should redirect to the separate visualization where we need to view the in-depth details only for DB and not for MEMBERDASHBOARD or TASKEDIT. Is it possible, please let me know.   

I know this thread is a few years old, but I hope you are still active. Splunk is not pulling the OID off of smartcards to handle the full login itself. So, we set up Apache and I made the remoteUser and RequestHeader configurations you described. When Splunk receives the header, nothing happens though. It logs an entry that ProxySSO is not configured. Have you seen this issue and know how to get past it to still use LDAP authentication in Splunk but passing the user name to from the Proxy via your described method?

Hi, Here is the query and the results. Visualization panels should get created/deleted automatically depends on the rows under the Page column.   index="*" appID="*" environment=* tags="*" stepName="*" status=FAILED | rex field=stepName "^(?<Page>[^\:]+)" | rex field=stepName "^\'(?<Page>[^\'\:]+)" | rex field=stepName "\:(?P<action>.*)" | eval Page=lower(Page) | stats count(scenario) as "Number of Scenarios" by Page | table Page, "Number of Scenarios"   I created the created single value visualization panel manually based on the rows, but if the rows are decreased dynamically, I could see N/A in most of the visualization panels. So, auto-scaling of visualization panel is needed in this scenario.    

@Mohd_Harahsheh9 Please find below the Tenable and Splunk integration documents.  Tenable and Splunk Integration Guide  Troubleshooting (tenable.com) Tenable Data in Splunk Dashboard  --- If this reply helps you, Karma would be appreciated.

@SCruz Follow the below document and go through your requirement to install the add-on or app in Splunk Cloud.  Install an add-on in Splunk Cloud Platform - Splunk Documentation  --- If this reply helps you, Karma would be appreciated.

Hi Thanks. This is almost what I need. I think I need to expand on my requirements a bit more.   ```Example``` |makeresults |eval sample="100" |eval perc="45" |eval name=if(sample=100,"C",N/A) |timechart max(sample) as "The Sample yields $name$", avg(perc) as "percentage" ```Expected Outcome would by a timechart with column named "The Sample yields C" and another column titled "percentage"``` Using the BY clause appends that eval'd field in the column name, but not all columns need that field name. I'd think that the easiest way about doing it would be some type of variable replacement but it seems that the AS clause does not allow that.

@abhi04  @abhi04 Hello Abhi, To on-board the logs you have to use Splunk Add-ons not Apps. They handle tasks related to data ingestion, parsing, extraction etc. Splunk-certified or written TAs (technology add-ons) adhere to the Common Information Model (CIM) and are often used for data parsing. An app in Splunk provides a front-end interface for visualizing data. It’s like a user-friendly dashboard that allows you to explore and analyze information. If this reply helps you, Karma would be appreciated. !!!