Pivotal Knowledge Base

Follow

After Renaming an App Splunk, Logs still Show the Old App Name

Environment

  • Pivotal Cloud Foundry (PCF) 1.11
  • Splunk Firehose Nozzle 1.0.0
  • Splunk endpoint

Symptom

After renaming an app with command "cf rename", Splunk logs still show the old app name.

Cause 

There is a parameter to tweak this behavior called “APP_CACHE_INVALIDATE_TTL” in the Splunk Firehose nozzle app. By default, this parameter is set to "0s", which means the nozzle will not update the cache once deployed. 

Resolution

Update the "APP_CACHE_INVALIDATE_TTL" value (ex: 60s, 60m) in the Splunk Firehose nozzle app and redeploy the app.

Note- If there is a large number of apps in the environment, use a higher TTL value to balance the increase in load.

Additional Information

See the Github page of the Cloud Foundry Open Source Community splunk-firehose-nozzle.

 

 

Comments

Powered by Zendesk