About file precedence and caching

Understanding how Splunk Enterprise handles file precedence and caching can help you during app development.

File precedence

When working with files in an app, such as dashboard source files (XML, HTML) and Splunk configuration files (CONF), be aware that Splunk looks for files from multiple locations starting with the Splunk Enterprise system folders, then app-specific folders, and then user-specific folders. In addition, each of these locations has a /default and /local subfolder, where original app files are located in /default, and any files edited by a user are located in the /local folder, thereby preserving any settings and modifications for each user.

The permissions you set for a dashboard determine the location for the dashboard source files:

  • Private: $SPLUNK_HOME/etc/users/username/appname/local/data/ui/...
  • Shared: $SPLUNK_HOME/etc/apps/appname/local/data/ui/...

The last file that is read is the one that is used.

As an example, let's say there is a mydash.xml dashboard for the admin user in the myapp app. Splunk looks for the mydash.xml source file in the following locations in this order:

    1. System folders:

    $SPLUNK_HOME/etc/system/default/data/ui/views/mydash.xml
    $SPLUNK_HOME/etc/system/local/data/ui/views/mydash.xml

    2. App-specific folders:

    $SPLUNK_HOME/etc/apps/myapp/default/data/ui/views/mydash.xml
    $SPLUNK_HOME/etc/apps/myapp/local/data/ui/views/mydash.xml

    3. User-specific folders:

    $SPLUNK_HOME/etc/users/admin/myapp/default/data/ui/views/mydash.xml
    $SPLUNK_HOME/etc/users/admin/myapp/local/data/ui/views/mydash.xml

For more about the order of precedence for configuration files, see Configuration file precedence in the Splunk Enterprise Admin Manual.

Client and server asset caching

Understanding how Splunk Enterprise caches files can help you during development and troubleshooting.

App files, configuration files, and static assets are cached on the client and on the server. Any time you make a change to these source files, you need to clear both client and server caches to see your changes. Restarting Splunk Enterprise always clears these caches, although most of the time a full restart is not necessary.

Update client assets

  • To update client assets, manually clear the browser cache.
  • During development, use the developer tools for your browser to disable the browser cache. For example, in Google Chrome you can use DevTools and select the Disable cache (while DevTools is open) option to always clear the cache.

Update server assets

  • Refresh system data (XML, HTML, and most CONF files) by going to http://<host:port>/debug/refresh.
  • The splunkd server caches certain files (such as JS, CSS, and HTML files). During development, you can use the following settings in the web.conf configuration file to disable the cache on the splunkd server:
    • cacheEntriesLimit = 0
      cacheBytesLimit = 0

    Note  These settings are not recommended for production.

Summary

To recap:

  • Use developer tools to disable the browser cache during development.
  • When you edit system data (XML, HTML, and most CONF files), use http://<host:port>/debug/refresh.
  • When you edit JS files, disable caching on splunkd and use http://<host:port>/debug/refresh.
  • When you modify CONF files, try http://<host:port>/debug/refresh first. If you don't see your changes, restart Splunk Enterprise.