web.conf

web.conf

web.conf contains settings for Splunk Web.

web.conf.spec

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0
#
# This file contains possible attributes and values you can use to configure Splunk's web interface.
#
# There is a web.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place a web.conf in $SPLUNK_HOME/etc/system/local/.  For examples, see web.conf.example.
# You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
[settings]
        * Set general Splunk Web configuration options under this stanza name.
        * Follow this stanza name with any number of the following attribute/value pairs.  
        * If you do not specify an entry for each attribute, Splunk will use the default value.
startwebserver = [0 | 1]
        * Set whether or not to start Splunk Web.
        * 0 disables Splunk Web, 1 enables it.
        * Defaults to 1.
httpport = <port_number>
        * Must be present for Splunk Web to start.
        * If omitted or 0 the server will NOT start an http listener.
        * Defaults to 8000.
mgmtHostPort = <IP:port>
        * Location of splunkd.
        * Don't include http[s]:// -- just the IP address.
        * Defaults to 127.0.0.1:8089.
enableSplunkWebSSL = [True | False]
        * Toggle between http or https.
        * Set to true to enable https and SSL.
        * Defaults to False.
sslport  = <port_number>
   * Must be present for the front-end to start.
   * If omitted, or given a value of 0 the server will not start an SSL listener
   
privKeyPath = /certs/privkey.pem
caCertPath = /certs/cert.pem
   * Specify paths and names for web SSL certs.
serviceFormPostURL = http://headlamp.Splunk.com/event/add
userRegistrationURL = https://www.Splunk.com/index.php/pre_reg?destination=prod_reg
updateCheckerBaseURL = http://quickdraw.Splunk.com/js/
   * These are various Splunk.com urls that are configurable. 
   * Setting updateCheckerBaseURL to 0 will stop the Splunk Web from pinging Splunk.com 
         for new versions of itself. 
isHosted = [True | False]
        * Sets 'hosted' mode, which controls whether users can save/alter options.
        * IMPORTANT: Setting this to true is not recommended.
        * Defaults to false.
disablePersistedPrefs = <string>
        * A comma-separated list of user-types.
        * When set, prefs changes for the users will not be persisted across sessions. 
         * For example, set to <User> to disable the persistence of preferences for all 'User' type accounts.  
         * Can also be User,Power,  User,Power,Admin etc... 
        * Generally useful when many people are sharing the same account.
        * Defaults to User.
uiversion = [pinesol | oxiclean]
        * Toggle which version of Splunk Web to load.
        * Must be set to either pinesol or oxiclean. 
        * When set to pinesol, Splunk will try to start with the legacy 2.1 and 2.2 front-end.
                * Not recommended in customer installations.
                * IMPORTANT: When using the pinesol front-end with Splunk 3.0, not all features will work correctly.  
twistedLoginTimeout = <seconds_until_timeout>
        * Number of seconds before the twisted session times out.
        * After <second_until_timeout>, idle users get redirected to login. 
        * Defaults to 3600.
restApiPostMode = [none | permissive | strict]
        * Set level of checking the REST API performs on form submissions.
        * none = does not check; GET and POST are allowed.
        * permissive = warns if REST method should be accessed via POST method.
        * strict = throws error if POST-only REST method is accessed via GET.
        * Defaults to strict.
enableRestControlApi = [True | False]
        * Toggle the REST API /v3/controlapi/ endpoint on or off.
        * Defaults to false.
distributedStatusMessages
        * Configuration for various status messages that can come back from servers  in distributed search.
        * Defaults to notauthenticated:bad auth,invaliduserorpsw:bad login,down:unreachable,versionMismatch:version mismatch,productMismatch:no license,missingServerName:no server name
numberOfEventsPerCard = <integer>
        * Configuration for the number of events that the Endless Scroller asks the 
     server for with each request.
        * Defaults to 10.
numberOfCardsPerDeck = <integer>
        * Configuration for the number of requests that the Endless Scroller will 
     make before it starts to recycle space occupied by prior pages.
        * Defaults to 7.
appLoggingLevel = [DEBUG | INFO | WARNING | ERROR | CRITICAL]
   * Set the logging level for the python appserver.
   * The output is separate from the main splunkd logs.
   * Writes to $SPLUNK_HOME/var/log/splunk/web_service.log
   * Defaults to INFO.
     
compressStaticFiles = [True | False]
   * Indicates if the static JS, CSS, XSL files are condensed or consolidated.
   * Enable to improve client-side performance.  
   * Defaults to True.
# Configuration options for the administration section of Splunk Web
[adminTabs]
        * Configure the order and appearance of Splunk Web's tabs under this stanza name.
        * Follow this stanza name with any number of the following attribute/value pairs.  
        * If you do not specify an entry for each attribute, Splunk will use the default value.
_order = <string>
        * Comma-separated values of tab paths. 
        * Controls the order of the tabs in Splunk Web.
        * Defaults to settings,datainputs,indexmanager,apps,distributed,users,saved,license
<pathToAdminSection>_label = <string>
        * Set the label on the tab that appears in Splunk Web.
        * Map from _order.
        * Defaults are:
                apps_label = Applications
        settings_label = Server
                datainputs_label = Data Inputs
        distributed_label = Distributed
        indexmanager_label = Indexes
        users_label = Users
        saved_label = Saved Searches
        license_label = License & Usage
<pathToAdminSection>_capabilities = <string>
        * Comma-separated list that maps the tabs in Splunk Web to roles.
        * Tab will only appear for users in one of those roles.
        * NOTE: For non-admin users there is a special tab called 'my account' that 
         appears, and that tab is not configurable here.
        * Defaults to:
                apps_capabilities = edit_applications
                settings_capabilities = server_settings_tab,server_control_tab,server_auth_config_tab
                datainputs_capabilities = edit_input,delete_input,edit_sourcetype,edit_tail,edit_tcp,edit_udp,edit_watch
                distributed_capabilities = distributed_all_tab,distributed_receive_tab,distributed_forward_tab,distributed_search_tab
                indexmanager_capabilities = edit_index
                users_capabilities = edit_user,user_tab
                saved_capabilities = save_global_search,save_local_search,delete_local_search,schedule_search,edit_local_search,edit_role_search,edit_saved_search,savedsearch_tab
                license_capabilities = license_tab
# Configuration options for the LiveTail section of Splunk Web
                
[livetail]
buffer_max_size = <integer>
        * Max size of stream events, items will be dropped after this limit is reached.
        * Defaults to 4000.
update_interval = <integer>
        * Delay in milliseconds before updating the UI with a stream event.
        * Defaults to 200.
multiple = <True | False>
        * WARNING! enabling multiple live tails with improper browser configuration may make splunk web to appear to be not working.
        * Please ensure HTTP pipelining http://en.wikipedia.org/wiki/HTTP_pipelining is enabled.
        * See http://www.freerepublic.com/focus/f-news/1299854/posts for firefox configuration.
        * Defaults to False.

web.conf.example

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This is an example web.conf.  Use this file to configure data web settings.
#
# To use one or more of these configurations, copy the configuration block into web.conf 
# in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
[settings]
# This stanza heading must precede any changes.
# Change the default port number:
httpport = 12800
# Turn on SSL:
enableSplunkWebSSL = true
sslport  = 8080
privKeyPath = /certs/privkey.pem
caCertPath = /certs/cert.pem
# Endless Scroller configuration.  
# If you deal with almost all multiline data, you may be better served by 
# lower defaults, which mean fewer events requested at a time.
numberOfEventsPerCard = 5
numberOfCardsPerDeck = 3

• Was this topic useful?
• Post a comment