When the implementation of Splunk 3.0 got underway, the ability to run either the old stable 2.0 User Interface or the new UI was key for many reasons. Thus a mechanism was built to allow the whole front end to be swapped out. If I recall correctly you could change which one was active on the CLI. This allowed the stable 2.0 UI to coexist with the then-newfangled 3.0 UI. A minor detail of the scheme was that a directory name had to be given to each UI available, and cleaning product names were chosen as a nod to the ajax craze at the time.
So the "search" directory suddenly became a dynamic choice made at runtime between "search_pinesol" for the old 2.0 UI, and "search_oxiclean" for 3.0 UI. The idea was that "pinesol" was good ol' dependable stable pinesol, whereas that "oxiclean" product was amazing, but ok it might damage or possibly ignite your sweaters, who knew. Take care.
Then when the 4.0 UI came along, which was another complete ground-up rewrite, and leaning even more into crazy ideas, we needed a cleaning product name that gave this same sense again, but this time with "oxiclean" in the role of the safe alternative. Leaning just as much or more into ajax conventions, but adding modularity and extensibility and the potential for the entire UI to be arbitrarily customized without the customer writing or maintaining any source code, an exceedingly strange name seemed in order and we landed on "Mr Sparkle". Thus the "search_mrsparkle" directory which is still there.
http://en.wikipedia.org/wiki/In_Marge_We_Trust
https://www.youtube.com/watch?v=f-S5PZb8MJE
And as an addendum - at some point long ago in 4.0.X or 4.1, when the ability to switch back to the old 3.0 UI was quietly removed, it would have made sense to rename search_mrsparkle back to just "search", but it didn't happen.
and last but not least, in old 4.0 builds, in the web_service.log the startup messages, I think in INFO, actually had the full transcript of the MrSparkle video.
