After upgrading from 6.3.7 to 6.5.2, we are getting the error on search: "Cannot get username when all users are selected".
Some people are getting this and some aren't.
We are also seeing different results for different browsers relative this error.
I had a customer run into this when going to 6.3.0 and it was resolved in 6.3.2:
I realize you are on a newer version but just for context (or other folks who have this error), I wanted to include that. Also, looking at this bug, there were some customers who had this error but it was due to other issues:
Issue occurred upgrading from 6.3.x to 6.4. Customer corrected by disabling sticky persistent session in F5, just turned it off. the persistence profile of load balancer was misconfigured.
They had NFS storage and there was a time issue: The NFS storage software was set to a different timezone than the server that was utilizing it. Although the date/time matched, the time zone was different. While investigating the web_service.log we noted many "Session expired" messages. Time drift on the NFS was heavily interfering with Splunk web. Correcting the time zone on the NFS fixed the issue. ** Just a further note, as we've just gone through Daylight Savings time here in most of the US, this could be a likely candidate or something else related to time skew and storage.