Security

Why Splunk Version 6.2.2 static URL does not return latest file?

lpolo
Motivator

We use the static splunk web service to access static files. Example:
http://splunkserver.com/en-US/static/app/appname/file.json

It has been working fine until the server was upgraded to version 6.2.2.

This was our previous config in server.conf. It did not have any issues.
[httpServer]
max-age = 3600
* Set the maximum time (in seconds) to cache a static asset served off of the '/static' directory.
* This value is passed along in the 'Cache-Control' HTTP header.
* Defaults to 3600.

I reduced the value to max-age=5. Problem continues.

0 Karma
1 Solution

lpolo
Motivator

Work around that solves the issue:

1) add the configuration stanza "appServerPorts = 0" in /opt/splunk/etc/system/local/web.conf
2) Restart splunk services /opt/splunk/bin/splunk restart

Role of the configuration change in appServerPorts:

appServerPorts =
* Port number(s) for the python-based application server to listen on.
This port is bound only on the loopback interface -- it is not
exposed to the network at large.
* If set to "0", this will prevent the application server from
being run from splunkd. Instead, splunkweb will be started as
a separate python-based service which directly listens to the
'httpport'. This is how Splunk 6.1.X and earlier behaved.
* Generally, you should only set one port number here. For most
deployments a single application server won't be a performance
bottleneck. However you can provide a comma-separated list of
port numbers here and splunkd will start a load-balanced
application server on each one.
* It is recommended that this be set to a non-zero value. Setting
this to "0" should only be done if you experience a compatibility
problem. The new separate application server configuration is faster
and supports more configuration options. Also, setting this to
"0" may cause problems when using the Search Head Clustering feature
(see the [shclustering] stanza in server.conf)
* Defaults to 8065.

View solution in original post

0 Karma

lpolo
Motivator

Work around that solves the issue:

1) add the configuration stanza "appServerPorts = 0" in /opt/splunk/etc/system/local/web.conf
2) Restart splunk services /opt/splunk/bin/splunk restart

Role of the configuration change in appServerPorts:

appServerPorts =
* Port number(s) for the python-based application server to listen on.
This port is bound only on the loopback interface -- it is not
exposed to the network at large.
* If set to "0", this will prevent the application server from
being run from splunkd. Instead, splunkweb will be started as
a separate python-based service which directly listens to the
'httpport'. This is how Splunk 6.1.X and earlier behaved.
* Generally, you should only set one port number here. For most
deployments a single application server won't be a performance
bottleneck. However you can provide a comma-separated list of
port numbers here and splunkd will start a load-balanced
application server on each one.
* It is recommended that this be set to a non-zero value. Setting
this to "0" should only be done if you experience a compatibility
problem. The new separate application server configuration is faster
and supports more configuration options. Also, setting this to
"0" may cause problems when using the Search Head Clustering feature
(see the [shclustering] stanza in server.conf)
* Defaults to 8065.

0 Karma

lpolo
Motivator

Splunk Tech support will file a bug against 6.2.2 Build 255606.

0 Karma

lpolo
Motivator

The only way I am able to get the latest file is by doing:

http://splunkserver.com/debug/refresh

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...