Getting Data In

Violent file caching in Splunk 6.2.x

mr_brightside
Explorer

Hi,

i've started to use Splunk 6.2.x some days before and experience a really big problems with file caching.

The point is that i'm writing different JS-modules for my application. When debugging it in 6.0.x or 6.1.x i just need to reload the page with cleaning of browser cache (CTRL+SHIFT+R or CTRL + F5 in Chrome) to see the results of how my script working.

In 6.2.x i have to restart whole server and clean out the browser cache to see the changes.

What wrong with it? It tooks 10 times more time to just see a little feature working.

I've checked the release notes, and there is even a word about this, as well as the forum didn't gave me any answers.

Could this be set up how it was in previous versions of Splunk?

0 Karma
1 Solution

mitch_1
Splunk Employee
Splunk Employee

Yes, basically even when we are serving nominally static assets, we need to go through the python stack for a couple boring reasons. To speed this up, 6.2 now aggressively caches these responses in the C++ layer which saves precious milliseconds when you log in.

You are right that this cache can get annoying when developing an app and are changing the static assets constantly . There are a couple ways to improve the experience.

First, you don't actually need to restart the whole server -- you can just run "splunk restart splunkweb" to kick just that component, which is much faster.

However, if you find yourself doing this a lot it's easier to just disable this cache entirely -- just add cacheEntriesLimit=0 to web.conf's [settings] stanza.

View solution in original post

mitch_1
Splunk Employee
Splunk Employee

Yes, basically even when we are serving nominally static assets, we need to go through the python stack for a couple boring reasons. To speed this up, 6.2 now aggressively caches these responses in the C++ layer which saves precious milliseconds when you log in.

You are right that this cache can get annoying when developing an app and are changing the static assets constantly . There are a couple ways to improve the experience.

First, you don't actually need to restart the whole server -- you can just run "splunk restart splunkweb" to kick just that component, which is much faster.

However, if you find yourself doing this a lot it's easier to just disable this cache entirely -- just add cacheEntriesLimit=0 to web.conf's [settings] stanza.

mr_brightside
Explorer

Worked for me, thanks!

for those, who could be confused with what web.conf to use the answer is:

$SPLUNK_HOME/etc/system/local/

If there is no web.conf, just place a file here with this inside:

[settings]
cacheEntriesLimit=0

restart Splunk, and you'll see the results. Although in my system i had to clean out the browser cache one last time. Now everything goes as desired.

Thanks again to mitch 1

0 Karma

dvg06
Path Finder

Worked for me too. Thanks muchly...

0 Karma
Get Updates on the Splunk Community!

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...