Hello, This is a known issue with the Web Framework in Splunk 6.0. We have a fix that will be 6.0.1 that should be released before the end of the year. There is no current workaround, besides not using alternate root endpoints. Sorry about this. Thanks Mark ... View more

Why not set a default for the input fields of * and use this search? search='index=testindex origin="$originatorKey$" recipient="$recipientKey$"' That way, if the user leaves one field empty, you will search for * instead, which seems much easier. Using your example, imagine the user inputs me@example.com as the originator and leaves the recipient empty. The search template would parse to search='index=testindex origin="me@examplecom" recipient="*"' which should find every email sent from me@example.com ... View more