Splunk web is configured to be accessed trough sso kerberos (mod_auth_kerb)
It work perfectly well, but some part of the application are not properly rendered.
when we click on some link a blank page is displayed instead of the expected result.
As i was observing what was going on i remarked the following :
When we select the application on the home page, the URL accessed by the browser is in the form:
http://search.domain.local/en-GB/ app /splunk_app_windows_infrastructure.
Then the Splunk Web (behind the scene ) rewrite this in the form
http://search.domain.local/ dj /en-GB/app/splunk_app_windows_infrastructure.
It inject a dj word in front of the relative URI.
My problem is that it does this only once (when I land on the homepage of the app).
All the view of the app are functional if we properly enter the URI manually (with the dj ango acronym in the middle)
The default navigation xml use relative URI without the in between dj word 
And when i select any link, Splunk web doesn't do its magic trick of injecting the dj word anymore
instead a blank page is displayed (without error)
Before I start to fix the various link in the default navigation , does someone has a clue on why the dj injection work only once ?
And does someone know why this application is doing this ?
