https://community.splunk.com/t5/Getting-Data-In/Session-timeout-not-only-for-user-inactivity-Is-there-a-way-to/m-p/401130#M71426 <P>Found the solution (thanks to Support). Sharing it for who is interested:</P> <P>Within Splunk all user session timeouts are the result of inactivity, so we effectively only close sessions if they exceed the configured idle time and we provide no mechanism to force sessions to expire/terminate.</P> <P>However, while it's not a supported feature we do track session tokens, so you could fashion your own solution to delete specific tokens (authentication/httpauth-tokens):</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.1/RESTREF/RESTaccess#authentication.2Fhttpauth-tokens.2F.7Bname.7D">https://docs.splunk.com/Documentation/Splunk/7.2.1/RESTREF/RESTaccess#authentication.2Fhttpauth-tokens.2F.7Bname.7D</A></P> <P>You could query the endpoint to list out all session tokens, then delete the token, for example:</P> <P>curl -k -u admin:changeme <A href="https://localhost:8089/services/authentication/httpauth-tokens">https://localhost:8089/services/authentication/httpauth-tokens</A></P> <P>curl -k -u admin:changeme --request DELETE <A href="https://localhost:8089/services/authentication/httpauth-tokens/vdZv2eB9F0842dyJhrIEiGNTcBMpBeGuwGPYxtGLKAESQkzjSjG7dbymQW58y%5EoI3kxYXWfK_Fd3cRGqwPQGp58RvEkzwCaC6PmQgCsK">https://localhost:8089/services/authentication/httpauth-tokens/vdZv2eB9F0842dyJhrIEiGNTcBMpBeGuwGPYxtGLKAESQkzjSjG7dbymQW58y^oI3kxYXWfK_Fd3cRGqwPQGp58RvEkzwCaC6PmQgCsK</A></P> <P>As mentioned above we provide no official mechanism for doing this, but you should be able to use the above to achieve the same result.</P> <P>Alternatively, since you have CA-Siteminder you should be able to enforce session time limits, through WebAgent-OnAuthAccept-Session-MaxTimeout for example - just note that I am not overly familiar with CA-Siteminder so can't advise on how this should be configured.</P> Mon, 22 Jul 2019 07:15:57 GMT clotti_splunk 2019-07-22T07:15:57Z https://community.splunk.com/t5/Getting-Data-In/Session-timeout-not-only-for-user-inactivity-Is-there-a-way-to/m-p/401129#M71425 <P>Hi guys,<BR />is there any way to set a "global" session timeout?<BR />Not only for user inactivity but for all users even if they are working!<BR />(I know, this look like a stupid question, but the customer asked it for security reason).<BR />Many thanks.</P> Fri, 05 Aug 2022 14:23:01 GMT https://community.splunk.com/t5/Getting-Data-In/Session-timeout-not-only-for-user-inactivity-Is-there-a-way-to/m-p/401129#M71425 clotti_splunk 2022-08-05T14:23:01Z https://community.splunk.com/t5/Getting-Data-In/Session-timeout-not-only-for-user-inactivity-Is-there-a-way-to/m-p/401130#M71426 <P>Found the solution (thanks to Support). Sharing it for who is interested:</P> <P>Within Splunk all user session timeouts are the result of inactivity, so we effectively only close sessions if they exceed the configured idle time and we provide no mechanism to force sessions to expire/terminate.</P> <P>However, while it's not a supported feature we do track session tokens, so you could fashion your own solution to delete specific tokens (authentication/httpauth-tokens):</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.1/RESTREF/RESTaccess#authentication.2Fhttpauth-tokens.2F.7Bname.7D">https://docs.splunk.com/Documentation/Splunk/7.2.1/RESTREF/RESTaccess#authentication.2Fhttpauth-tokens.2F.7Bname.7D</A></P> <P>You could query the endpoint to list out all session tokens, then delete the token, for example:</P> <P>curl -k -u admin:changeme <A href="https://localhost:8089/services/authentication/httpauth-tokens">https://localhost:8089/services/authentication/httpauth-tokens</A></P> <P>curl -k -u admin:changeme --request DELETE <A href="https://localhost:8089/services/authentication/httpauth-tokens/vdZv2eB9F0842dyJhrIEiGNTcBMpBeGuwGPYxtGLKAESQkzjSjG7dbymQW58y%5EoI3kxYXWfK_Fd3cRGqwPQGp58RvEkzwCaC6PmQgCsK">https://localhost:8089/services/authentication/httpauth-tokens/vdZv2eB9F0842dyJhrIEiGNTcBMpBeGuwGPYxtGLKAESQkzjSjG7dbymQW58y^oI3kxYXWfK_Fd3cRGqwPQGp58RvEkzwCaC6PmQgCsK</A></P> <P>As mentioned above we provide no official mechanism for doing this, but you should be able to use the above to achieve the same result.</P> <P>Alternatively, since you have CA-Siteminder you should be able to enforce session time limits, through WebAgent-OnAuthAccept-Session-MaxTimeout for example - just note that I am not overly familiar with CA-Siteminder so can't advise on how this should be configured.</P> Mon, 22 Jul 2019 07:15:57 GMT https://community.splunk.com/t5/Getting-Data-In/Session-timeout-not-only-for-user-inactivity-Is-there-a-way-to/m-p/401130#M71426 clotti_splunk 2019-07-22T07:15:57Z https://community.splunk.com/t5/Getting-Data-In/Session-timeout-not-only-for-user-inactivity-Is-there-a-way-to/m-p/608397#M105566 <P>Hello, this is really needed feature, also it seems http tokens are not accurate, I had one user without any more token and still doing searches. Thanks.</P> Fri, 05 Aug 2022 07:30:56 GMT https://community.splunk.com/t5/Getting-Data-In/Session-timeout-not-only-for-user-inactivity-Is-there-a-way-to/m-p/608397#M105566 splunkreal 2022-08-05T07:30:56Z