Getting Data In

Violent file caching in Splunk 6.2.x

mr_brightside
Explorer

Hi,

i've started to use Splunk 6.2.x some days before and experience a really big problems with file caching.

The point is that i'm writing different JS-modules for my application. When debugging it in 6.0.x or 6.1.x i just need to reload the page with cleaning of browser cache (CTRL+SHIFT+R or CTRL + F5 in Chrome) to see the results of how my script working.

In 6.2.x i have to restart whole server and clean out the browser cache to see the changes.

What wrong with it? It tooks 10 times more time to just see a little feature working.

I've checked the release notes, and there is even a word about this, as well as the forum didn't gave me any answers.

Could this be set up how it was in previous versions of Splunk?

0 Karma
1 Solution

mitch_1
Splunk Employee
Splunk Employee

Yes, basically even when we are serving nominally static assets, we need to go through the python stack for a couple boring reasons. To speed this up, 6.2 now aggressively caches these responses in the C++ layer which saves precious milliseconds when you log in.

You are right that this cache can get annoying when developing an app and are changing the static assets constantly . There are a couple ways to improve the experience.

First, you don't actually need to restart the whole server -- you can just run "splunk restart splunkweb" to kick just that component, which is much faster.

However, if you find yourself doing this a lot it's easier to just disable this cache entirely -- just add cacheEntriesLimit=0 to web.conf's [settings] stanza.

View solution in original post

mitch_1
Splunk Employee
Splunk Employee

Yes, basically even when we are serving nominally static assets, we need to go through the python stack for a couple boring reasons. To speed this up, 6.2 now aggressively caches these responses in the C++ layer which saves precious milliseconds when you log in.

You are right that this cache can get annoying when developing an app and are changing the static assets constantly . There are a couple ways to improve the experience.

First, you don't actually need to restart the whole server -- you can just run "splunk restart splunkweb" to kick just that component, which is much faster.

However, if you find yourself doing this a lot it's easier to just disable this cache entirely -- just add cacheEntriesLimit=0 to web.conf's [settings] stanza.

mr_brightside
Explorer

Worked for me, thanks!

for those, who could be confused with what web.conf to use the answer is:

$SPLUNK_HOME/etc/system/local/

If there is no web.conf, just place a file here with this inside:

[settings]
cacheEntriesLimit=0

restart Splunk, and you'll see the results. Although in my system i had to clean out the browser cache one last time. Now everything goes as desired.

Thanks again to mitch 1

0 Karma

dvg06
Path Finder

Worked for me too. Thanks muchly...

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...