Security

Why Splunk Version 6.2.2 static URL does not return latest file?

lpolo
Motivator

We use the static splunk web service to access static files. Example:
http://splunkserver.com/en-US/static/app/appname/file.json

It has been working fine until the server was upgraded to version 6.2.2.

This was our previous config in server.conf. It did not have any issues.
[httpServer]
max-age = 3600
* Set the maximum time (in seconds) to cache a static asset served off of the '/static' directory.
* This value is passed along in the 'Cache-Control' HTTP header.
* Defaults to 3600.

I reduced the value to max-age=5. Problem continues.

0 Karma
1 Solution

lpolo
Motivator

Work around that solves the issue:

1) add the configuration stanza "appServerPorts = 0" in /opt/splunk/etc/system/local/web.conf
2) Restart splunk services /opt/splunk/bin/splunk restart

Role of the configuration change in appServerPorts:

appServerPorts =
* Port number(s) for the python-based application server to listen on.
This port is bound only on the loopback interface -- it is not
exposed to the network at large.
* If set to "0", this will prevent the application server from
being run from splunkd. Instead, splunkweb will be started as
a separate python-based service which directly listens to the
'httpport'. This is how Splunk 6.1.X and earlier behaved.
* Generally, you should only set one port number here. For most
deployments a single application server won't be a performance
bottleneck. However you can provide a comma-separated list of
port numbers here and splunkd will start a load-balanced
application server on each one.
* It is recommended that this be set to a non-zero value. Setting
this to "0" should only be done if you experience a compatibility
problem. The new separate application server configuration is faster
and supports more configuration options. Also, setting this to
"0" may cause problems when using the Search Head Clustering feature
(see the [shclustering] stanza in server.conf)
* Defaults to 8065.

View solution in original post

0 Karma

lpolo
Motivator

Work around that solves the issue:

1) add the configuration stanza "appServerPorts = 0" in /opt/splunk/etc/system/local/web.conf
2) Restart splunk services /opt/splunk/bin/splunk restart

Role of the configuration change in appServerPorts:

appServerPorts =
* Port number(s) for the python-based application server to listen on.
This port is bound only on the loopback interface -- it is not
exposed to the network at large.
* If set to "0", this will prevent the application server from
being run from splunkd. Instead, splunkweb will be started as
a separate python-based service which directly listens to the
'httpport'. This is how Splunk 6.1.X and earlier behaved.
* Generally, you should only set one port number here. For most
deployments a single application server won't be a performance
bottleneck. However you can provide a comma-separated list of
port numbers here and splunkd will start a load-balanced
application server on each one.
* It is recommended that this be set to a non-zero value. Setting
this to "0" should only be done if you experience a compatibility
problem. The new separate application server configuration is faster
and supports more configuration options. Also, setting this to
"0" may cause problems when using the Search Head Clustering feature
(see the [shclustering] stanza in server.conf)
* Defaults to 8065.

0 Karma

lpolo
Motivator

Splunk Tech support will file a bug against 6.2.2 Build 255606.

0 Karma

lpolo
Motivator

The only way I am able to get the latest file is by doing:

http://splunkserver.com/debug/refresh

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...