Pivotal Knowledge Base


After Renaming an App Splunk, Logs still Show the Old App Name


  • Pivotal Cloud Foundry (PCF) 1.11
  • Splunk Firehose Nozzle 1.0.0
  • Splunk endpoint


After renaming an app with command "cf rename", Splunk logs still show the old app name.


There is a parameter to tweak this behavior called “APP_CACHE_INVALIDATE_TTL” in the Splunk Firehose nozzle app. By default, this parameter is set to "0s", which means the nozzle will not update the cache once deployed. 


Update the "APP_CACHE_INVALIDATE_TTL" value (ex: 60s, 60m) in the Splunk Firehose nozzle app and redeploy the app.

Note- If there is a large number of apps in the environment, use a higher TTL value to balance the increase in load.

Additional Information

See the Github page of the Cloud Foundry Open Source Community splunk-firehose-nozzle.




Powered by Zendesk