We figured out this is a bug in Splunk 6, and it has been reported to the dev team:
To repro:
Change your username to an email address format.
Create a dashboard with an inline search.
i.e. for inlined saved queries, the URl generated by the Splunk SearchManager tries to make this URL request internally:
https://localhost:8089/servicesNS/USER@foocorp.com/search/search/jobs?output_mode=json
Splunk's UI tries to extract the hostname from the URL, but the '@' sign in the email address causes problems and truncates the URL to "/search/search/jobs?output_mode=json". The function that does the truncation is the parseUri() function in the makeRequest() call.
makeRequest: function(url, message, callback) {
// Add our original destination to to headers,
// as some proxy implementations would rather
// use this.
message.headers["X-ProxyDestination"] = url;
// Need to remove the hostname from the URL
var parsed = parseUri(url);
var prefixToRemove = "" + (parsed.protocol ? parsed.protocol : "") + "://" + parsed.authority;
url = url.replace(new RegExp(escape(prefixToRemove), "i"), "");
Normally, Splunk inline XML queries default to the original username, so the solution was to URL encode this info:
createService: function(options) {
options = options || {};
var http = options.http || new sdk.ProxyHttp(config.PROXY_PATH);
options.version = options.version || "5.0";
options.app = options.app || utils.getPageInfo().app || "-";
options.owner = options.owner || splunkConfig.USERNAME;
options.owner = options.owner || encodeURIComponent(splunkConfig.USERNAME);
return new sdk.Service(http, options);
},
... View more