Configure user session timeouts
The amount of time that elapses before a user session with a Splunk platform instance times out depends on the interaction among three timeout settings:
- The
splunkweb
session timeout. - The
splunkd
session timeout. - The browser session timeout.
After the session times out, the next time the user sends a network request to the Splunk platform instance, it prompts them to log in again.
The splunkweb
and splunkd
timeouts determine the maximum idle time in the interaction between browser and the Splunk platform instance. The browser session timeout determines the maximum idle time in interaction between the user and browser.
The splunkweb
and splunkd
timeouts generally have the same value, as the same field sets both of them.
Set the user session timeout in Splunk Web
- Click Settings in the upper right-hand corner of Splunk Web.
- Under System, click Server settings.
- Click General settings.
- In the Session timeout field, enter a timeout value.
- Click Save.
This sets the user session timeout value for both the splunkweb
and splunkd
services. Initially, they share the same value of 60 minutes. They will continue to maintain identical values if you change the value through Splunk Web.
If you want to set the timeouts for splunkweb
and splunkd
to different values, you can do so by editing the configuration files, web.conf
setting tools.sessions.timeout
, and the server.conf
setting sessionTimeout
. There's no specific reason to give them different values. If the user is using Splunk Web to access the Splunk Enterprise instance, the smaller of the two timeout attributes prevails. For example, if the web.conf
setting tools.sessions.timeout
is set to "90" (minutes), and the server.conf
setting sessionTimeout
is set to "1h" (1 hour, or 60 minutes), the session uses the smallest timeout of 60 minutes.
In addition to setting the splunkweb
/splunkd
session value, you can also specify the timeout for the user browser session by editing the ui_inactivity_timeout
value in web.conf
. The Splunk browser session will time out once this value is reached. The default is 60 minutes. If ui_inactivity_timeout
is set to less than 1, there's no timeout -- the session will stay alive while the browser is open.
The countdown for the splunkweb
/splunkd
session timeout does not begin until the browser session reaches its timeout value. So, to determine how long the user has before timeout, add the value of ui_inactivity_timeout
to the smaller of the timeout values for splunkweb
and splunkd
. For example, assume the following:
splunkweb
timeout: 15m
splunkd
timeout: 20m
- browser (
ui_inactivity_timeout
) timeout: 10m
The user session stays active for 25 minutes (15m+10m). After 25 minutes of no activity, the session ends, and the instance prompts the user to log in again the next time they send a network request to the instance.
If you change a timeout value, either in Splunk Web or in configuration files, you must restart the Splunk platform instance for the change to take effect.
Configure user language and locale | Use a forward Proxy Server for splunkd |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1
Feedback submitted, thanks!