Security

Why Splunk Version 6.2.2 static URL does not return latest file?

lpolo
Motivator

We use the static splunk web service to access static files. Example:
http://splunkserver.com/en-US/static/app/appname/file.json

It has been working fine until the server was upgraded to version 6.2.2.

This was our previous config in server.conf. It did not have any issues.
[httpServer]
max-age = 3600
* Set the maximum time (in seconds) to cache a static asset served off of the '/static' directory.
* This value is passed along in the 'Cache-Control' HTTP header.
* Defaults to 3600.

I reduced the value to max-age=5. Problem continues.

0 Karma
1 Solution

lpolo
Motivator

Work around that solves the issue:

1) add the configuration stanza "appServerPorts = 0" in /opt/splunk/etc/system/local/web.conf
2) Restart splunk services /opt/splunk/bin/splunk restart

Role of the configuration change in appServerPorts:

appServerPorts =
* Port number(s) for the python-based application server to listen on.
This port is bound only on the loopback interface -- it is not
exposed to the network at large.
* If set to "0", this will prevent the application server from
being run from splunkd. Instead, splunkweb will be started as
a separate python-based service which directly listens to the
'httpport'. This is how Splunk 6.1.X and earlier behaved.
* Generally, you should only set one port number here. For most
deployments a single application server won't be a performance
bottleneck. However you can provide a comma-separated list of
port numbers here and splunkd will start a load-balanced
application server on each one.
* It is recommended that this be set to a non-zero value. Setting
this to "0" should only be done if you experience a compatibility
problem. The new separate application server configuration is faster
and supports more configuration options. Also, setting this to
"0" may cause problems when using the Search Head Clustering feature
(see the [shclustering] stanza in server.conf)
* Defaults to 8065.

View solution in original post

0 Karma

lpolo
Motivator

Work around that solves the issue:

1) add the configuration stanza "appServerPorts = 0" in /opt/splunk/etc/system/local/web.conf
2) Restart splunk services /opt/splunk/bin/splunk restart

Role of the configuration change in appServerPorts:

appServerPorts =
* Port number(s) for the python-based application server to listen on.
This port is bound only on the loopback interface -- it is not
exposed to the network at large.
* If set to "0", this will prevent the application server from
being run from splunkd. Instead, splunkweb will be started as
a separate python-based service which directly listens to the
'httpport'. This is how Splunk 6.1.X and earlier behaved.
* Generally, you should only set one port number here. For most
deployments a single application server won't be a performance
bottleneck. However you can provide a comma-separated list of
port numbers here and splunkd will start a load-balanced
application server on each one.
* It is recommended that this be set to a non-zero value. Setting
this to "0" should only be done if you experience a compatibility
problem. The new separate application server configuration is faster
and supports more configuration options. Also, setting this to
"0" may cause problems when using the Search Head Clustering feature
(see the [shclustering] stanza in server.conf)
* Defaults to 8065.

0 Karma

lpolo
Motivator

Splunk Tech support will file a bug against 6.2.2 Build 255606.

0 Karma

lpolo
Motivator

The only way I am able to get the latest file is by doing:

http://splunkserver.com/debug/refresh

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...