Configure user session timeouts
The amount of time that elapses before a Splunk user's session times out depends on the interaction among three timeout settings:
- The browser session timeout.
splunkd timeouts determine the maximum idle time in the interaction between browser and Splunk. The browser session timeout determines the maximum idle time in interaction between user and browser.
splunkd timeouts generally have the same value, as the same Manager field sets both of them. To set the timeout in Splunk Manager:
1. Click Manager in the upper right-hand corner of Splunk Web.
2. Under System configurations, click System settings.
3. Click General settings.
4. In the System timeout field, enter a timeout value.
5. Click Save.
This sets the user session timeout value for both
splunkd. Initially, they share the same value of 60 minutes. They will continue to maintain identical values, if you change the value through Manager.
If, for some reason, you need to set the timeouts for
splunkd to different values, you can do so by editing their underlying configuration files,
tools.sessions.timeout attribute) and
sessionTimeout attribute). For all practical purposes, there's no reason to give them different values. In any case, if the user is using SplunkWeb (
splunkweb) to access the Splunk instance (
splunkd), the smaller of the two timeout attributes prevails. So, if
web.conf has a value of "90" (minutes), and
server.conf has a value of "1h" (1 hour; 60 minutes), the session will timeout after 60 minutes.
In addition to setting the
splunkd session value, you can also specify the timeout for the user browser session by editing the
ui_inactivity_timeout value in
web.conf. The Splunk browser session will time out once this value is reached. The default is 60 minutes. If
ui_inactivity_timeout is set to less than 1, there's no timeout -- the session will stay alive while the browser is open.
The countdown for the
splunkd session timeout does not begin until the browser session reaches its timeout value. So, to determine how long the user has before timeout, add the value of
ui_inactivity_timeout to the smaller of the timeout values for
splunkd. For example, assume the following:
- browser (
ui_inactivity_timeout) timeout: 10m
The user session stays active for 25m (15m+10m). After 25 minutes of no activity, the user will be prompted to login again.
Note: If you change a timeout value, either in Manager or in configuration files, you must restart Splunk for the change to take effect.
Configure user language and locale
Add and edit roles
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18