Why doesn't my custom app icon appear immediately after I add the app in Splunk Web?

[Graham_Hanningt]

In Splunk 7.3.0, when I add an app via Splunk Web ("Install app from file"), the custom app icon doesn't appear immediately after I install the app. Instead, I get the default app icon: the word "App" inside a circle.

When I restart Splunk, the icon appears.

This additional step is mildly annoying.

Am I missing something?

[woodcock]

I do not know the answer but I know that @sideview does and he even knows how to make it work right away! Perhaps he will elucidate us?

[sideview]

If you manually request the image, does splunkWeb return a 404 or a 200? It seems very similar to the longstanding problem where people add a new dashboard.js or application.js or application.css, but it doesn't get loaded until SplunkWeb is restarted. Thinking about all this, I can't remember if the root cause is that splunkWeb refuses to serve net-new static files until a restart, or if that condition applies only to appllication.* and dashboard.* and is more of a cache problem in the python code.

Along the same line, if you can log into the host itself then another thing to try is to just restart splunkweb.

splunk restart splunkweb

Kicking splunk boots everyone out and makes everyone come at you with pitchforks. restarting just "splunkweb" wont do that and will generally just give everyone a few seconds of o_O while requests spin a bit.

[DavidHourani]

Hi @Graham_Hannington,

Seems like a browser cache issue. Have you tried installing/reinstalling the same app multiple times ? If so it could be that you're stuck with your initial CSS.

Instead of having to go for unnecessary restarts you can use the _bump endpoint to refresh your JS and CSS:

https://yoursplunkurl/en-US/_bump

Let me know if that helps.

Cheers,
David

[Graham_Hanningt]

Thanks for the reply and suggestions. Unfortunately, no, that doesn't help.

After experiencing this issue in an existing Splunk instance—where I had indeed installed/reinstalled the app several times, but in every case with custom icons—I deliberately started a fresh Splunk instance in a new Docker container. And I opened that Splunk Web in a browser with an empty cache.

I installed the app in that fresh Splunk. I got the default app icon. The bump endpoint didn't fix it.

I restarted Splunk, and the custom app icon appeared.

[Graham_Hanningt]

In case it's significant: the first thing I do after starting Splunk in a new Docker container is to change the license group from Trial to Free. I do that before installing any apps.

[DavidHourani]

weird, I was checking other links as well :

https://answers.splunk.com/answers/730887/why-does-my-app-icon-not-display-on-the-bar-or-app.html
https://answers.splunk.com/answers/667402/splunk-700-app-icon-not-appearing.html
https://answers.splunk.com/answers/775555/custom-app-icons-not-showing.html

Only one mentions https://yoursplunkurl//en-GB/debug/refresh as a possible solution, none mentions _bump and most of them mention restarting as well as a solution for that...

Doesn't seem viable to restart every time you change or add an app with a new icon though, the _bump and refresh endpoint should reload your icons.

[Graham_Hanningt]

_bump doesn't work for this, and refresh is not an option:

https://answers.splunk.com/answers/311531/debugrefresh-does-not-work-anymore-on-630-on-versi.html

[DavidHourani]

yeah exactly... so you have no options available with the free version, is this for a dev or production environment ? If you're using it for dev you can consider getting a free personal developper license : https://www.splunk.com/en_us/resources/personalized-dev-test-licenses.html

[Graham_Hanningt]

Mostly dev. Not production. What I'm actually doing is testing the installation of an app that I've developed after renaming the app's local directory to default, and making a few other tweaks to turn the "in-development" app into a "for-distribution" app.

In dev, I'm not really that concerned about this behavior. It's a slight annoyance. As you say, a dev license might (would?) help.

But my dev environment is not my major concern. When I think about distributing the app to other users to install on their own Splunk instances, I cringe at the thought of having to explain this behavior. The app icon should appear after you install the app using Splunk Web. You shouldn't have to "prod" Splunk—refresh, bump, restart—to make it display the custom app icon.

This seems like such an obvious, in-your-user's-face issue that I almost can't believe this really is the situation; that you have do something extra to see the custom icon. It really does make me think I'm missing something. But all of the anecdotal evidence I read confirms that, yep, what I'm experiencing is just the way it is.

[DavidHourani]

"The app icon should appear after you install the app using Splunk Web" --> Yeah that's the default behavior, icon only requires refresh after you modify it or add a new one but not after a fresh install...

Which folder do you have your logos/icons in ?

[Graham_Hanningt]

Apologies for the belated reply.

I store the app icon files in:

$SPLUNK_HOME/etc/apps/<your_app_name>/static/

as described in the Splunk dev docs heading "Add icons to your app".

I deliberately supply only the following files:

appIcon_2x.png
appIcon.png
appIconAlt_2x.png
appIconAlt.png

I don't want to supply a logo: I'm happy with the default "logo" of the app title next to the icon.