Splunk® Enterprise

Admin Manual

Download manual as PDF

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Download topic as PDF

Configure user session timeouts

The amount of time that elapses before a Splunk user's session times out depends on the interaction among three timeout settings:

  • The splunkweb session timeout.
  • The splunkd session timeout.
  • The browser session timeout.

The splunkweb and splunkd timeouts determine the maximum idle time in the interaction between browser and Splunk. The browser session timeout determines the maximum idle time in interaction between user and browser.

The splunkweb and splunkd timeouts generally have the same value, as the same field sets both of them. To set the timeout in Splunk Web:

  1. Click Settings in the upper right-hand corner of Splunk Web.
  2. Under System, click Server settings.
  3. Click General settings.
  4. In the Session timeout field, enter a timeout value.
  5. Click Save.

This sets the user session timeout value for both splunkweb and splunkd. Initially, they share the same value of 60 minutes. They will continue to maintain identical values if you change the value through Splunk Web.

If, for some reason, you need to set the timeouts for splunkweb and splunkd to different values, you can do so by editing their underlying configuration files, web.conf (tools.sessions.timeout attribute) and server.conf (sessionTimeout attribute). For all practical purposes, there's no reason to give them different values. In any case, if the user is using SplunkWeb (splunkweb) to access the Splunk instance (splunkd), the smaller of the two timeout attributes prevails. So, if tools.sessions.timeout in web.conf has a value of "90" (minutes), and sessionTimeout in server.conf has a value of "1h" (1 hour; 60 minutes), the session will timeout after 60 minutes.

In addition to setting the splunkweb/splunkd session value, you can also specify the timeout for the user browser session by editing the ui_inactivity_timeout value in web.conf. The Splunk browser session will time out once this value is reached. The default is 60 minutes. If ui_inactivity_timeout is set to less than 1, there's no timeout -- the session will stay alive while the browser is open.

The countdown for the splunkweb/splunkd session timeout does not begin until the browser session reaches its timeout value. So, to determine how long the user has before timeout, add the value of ui_inactivity_timeout to the smaller of the timeout values for splunkweb and splunkd. For example, assume the following:

  • splunkweb timeout: 15m
  • splunkd timeout: 20m
  • browser (ui_inactivity_timeout) timeout: 10m

The user session stays active for 25m (15m+10m). After 25 minutes of no activity, the user will be prompted to login again.

Note: If you change a timeout value, either in Splunk Web or in configuration files, you must restart Splunk for the change to take effect.

Last modified on 07 August, 2019
Configure user language and locale
Use a forward Proxy Server for splunkd

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters