Archive

Violent file caching in Splunk 6.2.x

Explorer

Hi,

i've started to use Splunk 6.2.x some days before and experience a really big problems with file caching.

The point is that i'm writing different JS-modules for my application. When debugging it in 6.0.x or 6.1.x i just need to reload the page with cleaning of browser cache (CTRL+SHIFT+R or CTRL + F5 in Chrome) to see the results of how my script working.

In 6.2.x i have to restart whole server and clean out the browser cache to see the changes.

What wrong with it? It tooks 10 times more time to just see a little feature working.

I've checked the release notes, and there is even a word about this, as well as the forum didn't gave me any answers.

Could this be set up how it was in previous versions of Splunk?

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Yes, basically even when we are serving nominally static assets, we need to go through the python stack for a couple boring reasons. To speed this up, 6.2 now aggressively caches these responses in the C++ layer which saves precious milliseconds when you log in.

You are right that this cache can get annoying when developing an app and are changing the static assets constantly . There are a couple ways to improve the experience.

First, you don't actually need to restart the whole server -- you can just run "splunk restart splunkweb" to kick just that component, which is much faster.

However, if you find yourself doing this a lot it's easier to just disable this cache entirely -- just add cacheEntriesLimit=0 to web.conf's [settings] stanza.

View solution in original post

Splunk Employee
Splunk Employee

Yes, basically even when we are serving nominally static assets, we need to go through the python stack for a couple boring reasons. To speed this up, 6.2 now aggressively caches these responses in the C++ layer which saves precious milliseconds when you log in.

You are right that this cache can get annoying when developing an app and are changing the static assets constantly . There are a couple ways to improve the experience.

First, you don't actually need to restart the whole server -- you can just run "splunk restart splunkweb" to kick just that component, which is much faster.

However, if you find yourself doing this a lot it's easier to just disable this cache entirely -- just add cacheEntriesLimit=0 to web.conf's [settings] stanza.

View solution in original post

Explorer

Worked for me, thanks!

for those, who could be confused with what web.conf to use the answer is:

$SPLUNK_HOME/etc/system/local/

If there is no web.conf, just place a file here with this inside:

[settings]
cacheEntriesLimit=0

restart Splunk, and you'll see the results. Although in my system i had to clean out the browser cache one last time. Now everything goes as desired.

Thanks again to mitch 1

0 Karma

Path Finder

Worked for me too. Thanks muchly...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!