topic Re: Why Splunk Version 6.2.2 static URL does not return latest file? in Security

Why Splunk Version 6.2.2 static URL does not return latest file?

lpolo — Mon, 02 Mar 2015 18:19:58 GMT

We use the static splunk web service to access static files. Example:
http://splunkserver.com/en-US/static/app/appname/file.json

It has been working fine until the server was upgraded to version 6.2.2.

This was our previous config in server.conf. It did not have any issues.
[httpServer]
max-age = 3600
* Set the maximum time (in seconds) to cache a static asset served off of the '/static' directory.
* This value is passed along in the 'Cache-Control' HTTP header.
* Defaults to 3600.

I reduced the value to max-age=5. Problem continues.

Re: Why Splunk Version 6.2.2 static URL does not return latest file?

lpolo — Mon, 02 Mar 2015 18:31:27 GMT

The only way I am able to get the latest file is by doing:

http://splunkserver.com/debug/refresh

Re: Why Splunk Version 6.2.2 static URL does not return latest file?

lpolo — Tue, 03 Mar 2015 15:21:12 GMT

Work around that solves the issue:

1) add the configuration stanza "appServerPorts = 0" in /opt/splunk/etc/system/local/web.conf
2) Restart splunk services /opt/splunk/bin/splunk restart

Role of the configuration change in appServerPorts:

appServerPorts =
* Port number(s) for the python-based application server to listen on.
This port is bound only on the loopback interface -- it is not
exposed to the network at large.
* If set to "0", this will prevent the application server from
being run from splunkd. Instead, splunkweb will be started as
a separate python-based service which directly listens to the
'httpport'. This is how Splunk 6.1.X and earlier behaved.
* Generally, you should only set one port number here. For most
deployments a single application server won't be a performance
bottleneck. However you can provide a comma-separated list of
port numbers here and splunkd will start a load-balanced
application server on each one.
* It is recommended that this be set to a non-zero value. Setting
this to "0" should only be done if you experience a compatibility
problem. The new separate application server configuration is faster
and supports more configuration options. Also, setting this to
"0" may cause problems when using the Search Head Clustering feature
(see the [shclustering] stanza in server.conf)
* Defaults to 8065.

Re: Why Splunk Version 6.2.2 static URL does not return latest file?

lpolo — Tue, 03 Mar 2015 16:33:32 GMT

Splunk Tech support will file a bug against 6.2.2 Build 255606.