topic Re: Terminate User Session in Security

Can a Splunk admin terminate a user session?

ogdin — Thu, 04 Aug 2022 16:03:17 GMT

Can a Splunk admin terminate a user session?

Re: Terminate User Session

ziegfried — Thu, 16 Sep 2010 21:02:48 GMT

It's not possible via the UI, but it can be done. It's a little tricky though:

Find the user's session via a REST endpoint of splunkd:

https://localhost:8089/services/authentication/httpauth-tokens

You can see the current session tokens. Find the one of the user you want to kick out and copy the link address of the token. Something like

https://localhost:8089/services/authentication/httpauth-tokens/4b298e3f7c3aa937f114f3657dbd5314

And then kill the session by executing the following command on the splunk server:

splunk _internal call "https://localhost:8089/services/authentication/httpauth-tokens/4b298e3f7c3aa937f114f3657dbd5314" -method DELETE

Re: Terminate User Session

phoenixdigital — Tue, 07 Jan 2014 01:44:00 GMT

Is there a better way to do this yet via the web console?

We had an issue where someone was on leave and had a Splunk session open which they had configured to refresh every 5 seconds. They have been told not to do this anymore.

There was noone on staff over Christmas/New Year who could have performed this ssh command.

I would have hoped there should be an easier way?

Apart from restarting Splunk that is.

Re: Terminate User Session

vin02ptl — Wed, 08 Jul 2020 14:12:48 GMT

run splunk logout ,it will terminate the current session

Re: Terminate User Session

splunkreal — Tue, 16 Mar 2021 16:12:19 GMT

This should be implemented in Splunk GUI 🙂

Re: Terminate User Session

splunkreal — Thu, 04 Aug 2022 15:54:47 GMT

Hello,

this is not accurate, can't find http tokens but user still doing searches.

Thanks.

Re: Terminate User Session

dural_yyz — Thu, 04 Aug 2022 19:13:24 GMT

Please differentiate between a user doing "ad hoc" searches via the Web GUI and "saved searches" which will run on a time pattern(CRON) regardless of users current GUI access.

Re: Terminate User Session

splunkreal — Fri, 05 Aug 2022 07:08:28 GMT

Still now difficult to identify where users are connected from except if you search Splunk load balancers / web servers.

Re: Terminate User Session

dural_yyz — Fri, 05 Aug 2022 12:33:40 GMT

index=_audit sourcetype=audittrail action IN ("login attempt" logout) | table _time host user info reason clientip method session

If you add a filter on the user field you can narrow down to specific account.

- clientip: source IP of connection, obviously NAT could hide the source but that's up to your network layout

- session: this is the http auth token that other users have already shown how to force delete from the system