topic Re: Why is the Splunk user session timeout is not working? in Security

Why is the Splunk user session timeout is not working?

Dev_Choudhary — Mon, 12 Feb 2018 18:34:42 GMT

Hi,

I have set the below in web.conf to set the user timeout session to 20 min but it's not working, any idea where is the issue:

web.conf
[settings]
tools.sessions.timeout = 10
ui_inactivity_timeout = 10

server.conf
[general]
sessionTimeout = 600s

Re: Why is the Splunk user session timeout is not working?

richgalloway — Mon, 12 Feb 2018 19:55:26 GMT

Did you restart Splunk after changing the settings?

Re: Why is the Splunk user session timeout is not working?

493669 — Tue, 13 Feb 2018 01:42:20 GMT

HI @Dev_Choudhary,

If you are using SplunkWeb (splunkweb) to access the Splunk instance (splunkd), the smaller of the two timeout attributes prevails. So, if tools.sessions.timeout in web.conf has a value of "90" (minutes), and sessionTimeout in server.conf has a value of "1h" (1 hour; 60 minutes), the session will timeout after 60 minutes.
refer https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Configureusertimeouts

Re: Why is the Splunk user session timeout is not working?

Dev_Choudhary — Tue, 13 Feb 2018 07:30:41 GMT

yes, by both way 1> from web console and 2> by command

Re: Why is the Splunk user session timeout is not working?

493669 — Tue, 13 Feb 2018 08:03:05 GMT

I can see that you have set timeout session to 10 min and not 20 min...does it also not working for 10min?

Re: Why is the Splunk user session timeout is not working?

joshualemoine — Thu, 21 Oct 2021 21:39:18 GMT

Same issue, similar settings, but ours is set to 15m. The timeout has not changed and still timeouts after 1 hour. The only thing worth nothing is that we are using Okta and have SAML auth enabled. So users have to MFA to get into Splunk, but I would still think the internal Splunk settings would push the user out of the web console if set per the instructions: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Configureusertimeouts

Anyone found an answer yet?