web.conf

web.conf

web.conf contains settings for Splunk Web.

web.conf.spec

# This file contains possible attributes and values you can use to configure Splunk's web interface.
#
# There is a web.conf in $SPLUNK_HOME/etc/bundles/default/.  To set custom configurations, 
# place a web.conf in your own custom bundle directory.  For examples, see web.conf.example.
#
# For help creating a bundle directory, or to learn more about bundles (including bundle precedence)
# please see the documentation located at http://www.splunk.com/doc/latest/admin/bundleconfig.
#
[settings]
	* Set general SplunkWeb configuration options under this stanza name.
	* Follow this stanza name with any number of the following attribute/value pairs.  
	* If you do not specify an entry for each attribute, Splunk will use the default value.
startwebserver = [0 | 1]
   	* Set whether or not to start SplunkWeb.
   	* 0 disables SplunkWeb, 1 enables it.
   	* Defaults to 1.
httpport = <port_number>
   	* Must be present for SplunkWeb to start.
   	* If omitted or 0 the server will NOT start an http listener.
   	* Defaults to 8000.
mgmtHostPort = <IP:port>
   	* Location of splunkd.
   	* Don't include http[s]:// -- just the IP address.
   	* Defaults to 127.0.0.1:8089.
enableSplunkWebSSL = [True | False]
	* Toggle between http or https.
	* Set to true to enable https and SSL.
	* Defaults to False.
sslport  = <port_number>
   * Must be present for the front-end to start.
   * If omitted, or given a value of 0 the server will not start an SSL listener
   
privKeyPath = @OsDirSep@certs@OsDirSep@privkey.pem
caCertPath = @OsDirSep@certs@OsDirSep@cert.pem
   * values that will shortly move out of web.conf, and into a different file 
	 called either ssl.conf or server.conf
serviceFormPostURL = http://headlamp.Splunk.com/event/add
userRegistrationURL = https://www.Splunk.com/index.php/pre_reg?destination=prod_reg
updateCheckerBaseURL = http://quickdraw.Splunk.com/js/
   * These are various Splunk.com urls that are configurable. 
   * Setting updateCheckerBaseURL to 0 will stop the SplunkWeb from pinging Splunk.com 
	 for new versions of itself. 
isHosted = [True | False]
   	* Sets 'hosted' mode, which controls whether users can save/alter options.
   	* IMPORTANT: Setting this to true is not recommended.
   	* Defaults to false.
disablePersistedPrefs = <string>
  	* A comma-separated list of user-types.
   	* When set, prefs changes for the users will not be persisted across sessions. 
  	 * For example, set to <User> to disable the persistence of preferences for all 'User' type accounts.  
   	 * Can also be User,Power,  User,Power,Admin etc... 
   	* Generally useful when many people are sharing the same account.
   	* Defaults to User.
uiversion = [pinesol | oxiclean]
   	* Toggle which version of SplunkWeb to load.
   	* Must be set to either pinesol or oxiclean. 
  	* When set to pinesol, Splunk will try to start with the legacy 2.1 and 2.2 front-end.
  		* Not recommended in customer installations.
   		* IMPORTANT: When using the pinesol front-end with Splunk 3.0, not all features will work correctly.  
twistedLoginTimeout = <seconds_until_timeout>
   	* Number of seconds before the twisted session times out.
   	* After <second_until_timeout>, idle users get redirected to login. 
   	* Defaults to 3600.
restApiPostMode = [none | permissive | strict]
   	* Set level of checking the REST API performs on form submissions.
   	* none = does not check; GET and POST are allowed.
   	* permissive = warns if REST method should be accessed via POST method.
   	* strict = throws error if POST-only REST method is accessed via GET.
   	* Defaults to permissive.
enableRestControlApi = [True | False]
  	* Toggle the REST API /v3/controlapi/ endpoint on or off.
   	* Defaults to false.
distributedStatusMessages
   	* Configuration for various status messages that can come back from servers  in distributed search.
   	* Defaults to notauthenticated:bad auth,invaliduserorpsw:bad login,down:unreachable,versionMismatch:version mismatch,productMismatch:no license,missingServerName:no server name
numberOfEventsPerCard = <integer>
   	* Configuration for the number of events that the Endless Scroller asks the 
     server for with each request.
   	* Defaults to 10.
numberOfCardsPerDeck = <integer>
   	* Configuration for the number of requests that the Endless Scroller will 
     make before it starts to recycle space occupied by prior pages.
   	* Defaults to 7.
appLoggingLevel = [DEBUG | INFO | WARNING | ERROR | CRITICAL]
   * Set the logging level for the python appserver.
   * The output is separate from the main splunkd logs.
   * Writes to $SPLUNK_HOME/var/log/splunk/web_service.log
   * Defaults to INFO.
     
compressStaticFiles = [True | False]
   * Indicates if the static JS, CSS, XSL files are condensed or consolidated.
   * Enable to improve client-side performance.  
   * Defaults to True.
#
# Configuration options for the administration section of SplunkWeb
#
[adminTabs]
# adding or subtracting from the _roles values isn't supported, although
# subtracting will effectively remove that tab from the UI
#
# adding new tabs (ie bicycles_label,  bicycles_roles) is also not supported
# at all.  You'd create the tab in the UI, but it would just throw an error when
# clicked upon.
_order = settings,datainputs,distributed,users,saved,license
settings_label = Server
settings_capabilities = server_settings_tab,server_control_tab,server_auth_config_tab
datainputs_label = Data Inputs
datainputs_capabilities = edit_input,delete_input,edit_sourcetype,edit_tail,edit_tcp,edit_udp,edit_watch
distributed_label = Distributed
distributed_capabilities = distributed_all_tab,distributed_receive_tab,distributed_forward_tab,distributed_search_tab
# Note, this tab will ALWAYS show up for user and power, it will not have any of
# the admin functionality though, it links to the users own profile page for them
# to edit their own password or username. please email support@splunk.com if you want to
# remove the user profile tab.
users_label = Users
users_capabilities = edit_user,user_tab
saved_label = Saved Searches
saved_capabilities = save_global_search,save_local_search,delete_local_search,schedule_search,edit_local_search,edit_role_search,edit_saved_search,savedsearch_tab
license_label = License & Usage
license_capabilities = license_tab
[adminTabs]
	* Configure the order and appearance of SplunkWeb's tabs under this stanza name.
	* Follow this stanza name with any number of the following attribute/value pairs.  
	* If you do not specify an entry for each attribute, Splunk will use the default value.
_order = <string>
  	* Comma-separated values of tab paths. 
   	* Controls the order of the tabs in SplunkWeb.
   	* Defaults to settings,datainputs,distributed,users,saved,license.
<pathToAdminSection>_label = <string>
   	* Set the label on the tab that appears in SplunkWeb.
   	* Map from _order.
   	* Defaults are:
    	settings_label = Server
   	 	datainputs_label = Data Inputs
    	distributed_label = Distributed
    	users_label = Users
    	saved_label = Saved Searches
    	license_label = License & Usage
<pathToAdminSection>_capabilities = <string>
   	* Comma-separated list that maps the tabs in SplunkWeb to roles.
   	* Tab will only appear for users in one of those roles.
   	* NOTE: For non-admin users there is a special tab called 'my account' that 
	 appears, and that tab is not configurable here.
   	* Defaults to:
		settings_capabilities = server_settings_tab,server_control_tab,server_auth_config_tab
		datainputs_capabilities = edit_input,delete_input,edit_sourcetype,edit_tail,edit_tcp,edit_udp,edit_watch
		distributed_capabilities = distributed_all_tab,distributed_receive_tab,distributed_forward_tab,distributed_search_tab
		users_capabilities = edit_user,user_tab
		saved_capabilities = save_global_search,save_local_search,delete_local_search,schedule_search,edit_local_search,edit_role_search,edit_saved_search,savedsearch_tab
		license_capabilities = license_tab

web.conf.example

# This is an example web.conf.  Use this file to configure data web settings.
#
# There is a web.conf in the default directory ($SPLUNK_HOME/etc/bundles/default/). 
# To set custom configurations, place a web.conf in your own custom bundle directory.
[settings]
# This stanza heading must precede any changes.
# Change the default port number:
httpport = 12800
# Turn on SSL:
enableSplunkWebSSL = true
sslport  = 8080
privKeyPath = /certs/privkey.pem
caCertPath = /certs/cert.pem
# Endless Scroller configuration.  
# If you deal with almost all multiline data, you may be better served by 
# lower defaults, which mean fewer events requested at a time.
numberOfEventsPerCard = 5
numberOfCardsPerDeck = 3

• Was this topic useful?
• Post a comment