Getting Data In

Violent file caching in Splunk 6.2.x

mr_brightside
Explorer

Hi,

i've started to use Splunk 6.2.x some days before and experience a really big problems with file caching.

The point is that i'm writing different JS-modules for my application. When debugging it in 6.0.x or 6.1.x i just need to reload the page with cleaning of browser cache (CTRL+SHIFT+R or CTRL + F5 in Chrome) to see the results of how my script working.

In 6.2.x i have to restart whole server and clean out the browser cache to see the changes.

What wrong with it? It tooks 10 times more time to just see a little feature working.

I've checked the release notes, and there is even a word about this, as well as the forum didn't gave me any answers.

Could this be set up how it was in previous versions of Splunk?

0 Karma
1 Solution

mitch_1
Splunk Employee
Splunk Employee

Yes, basically even when we are serving nominally static assets, we need to go through the python stack for a couple boring reasons. To speed this up, 6.2 now aggressively caches these responses in the C++ layer which saves precious milliseconds when you log in.

You are right that this cache can get annoying when developing an app and are changing the static assets constantly . There are a couple ways to improve the experience.

First, you don't actually need to restart the whole server -- you can just run "splunk restart splunkweb" to kick just that component, which is much faster.

However, if you find yourself doing this a lot it's easier to just disable this cache entirely -- just add cacheEntriesLimit=0 to web.conf's [settings] stanza.

View solution in original post

mitch_1
Splunk Employee
Splunk Employee

Yes, basically even when we are serving nominally static assets, we need to go through the python stack for a couple boring reasons. To speed this up, 6.2 now aggressively caches these responses in the C++ layer which saves precious milliseconds when you log in.

You are right that this cache can get annoying when developing an app and are changing the static assets constantly . There are a couple ways to improve the experience.

First, you don't actually need to restart the whole server -- you can just run "splunk restart splunkweb" to kick just that component, which is much faster.

However, if you find yourself doing this a lot it's easier to just disable this cache entirely -- just add cacheEntriesLimit=0 to web.conf's [settings] stanza.

mr_brightside
Explorer

Worked for me, thanks!

for those, who could be confused with what web.conf to use the answer is:

$SPLUNK_HOME/etc/system/local/

If there is no web.conf, just place a file here with this inside:

[settings]
cacheEntriesLimit=0

restart Splunk, and you'll see the results. Although in my system i had to clean out the browser cache one last time. Now everything goes as desired.

Thanks again to mitch 1

0 Karma

dvg06
Path Finder

Worked for me too. Thanks muchly...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...