https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147096#M1689 <P>This is not unique to Splunk. It is the nature of IP and HTTP protocols - they are stateless. So, you cannot really track a 'session' since there is none to track. Each request is treated as an independent transaction. </P> <P>More information can be found at <A href="http://en.wikipedia.org/wiki/Stateless_protocol">http://en.wikipedia.org/wiki/Stateless_protocol</A></P> Mon, 08 Jun 2015 13:19:53 GMT dlayvand_splunk 2015-06-08T13:19:53Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147091#M1684 <P>This document helps me know how to track logins and logoffs: <A href="http://answers.splunk.com/answers/108923/how-to-track-a-specific-user-login-and-logoff-the-past-30-days.html">http://answers.splunk.com/answers/108923/how-to-track-a-specific-user-login-and-logoff-the-past-30-days.html</A> </P> <P>However, in my organization, no one really logs off from Splunk. They just close the browser window or shut off their computer. Is there a good way to track this action?</P> Mon, 08 Dec 2014 18:17:25 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147091#M1684 feickertmd 2014-12-08T18:17:25Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147092#M1685 <P>No, because Splunk has no way of knowing whether someone closed the browser window. All that happens is that requests stop coming from the browser.</P> Mon, 08 Dec 2014 19:38:42 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147092#M1685 Ayn 2014-12-08T19:38:42Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147093#M1686 <P>so is there a timeout for the login? And then the user is forcibly logged off?</P> Mon, 08 Dec 2014 19:39:45 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147093#M1686 feickertmd 2014-12-08T19:39:45Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147094#M1687 <P>Yes, that is configurable. More details here..<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Configureusertimeouts">http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Configureusertimeouts</A></P> Mon, 08 Dec 2014 19:49:42 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147094#M1687 pradeepkumarg 2014-12-08T19:49:42Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147095#M1688 <P>Not so much "logged off" as that the user's session expires and the corresponding session cookies are invalidated. This is not logged anywhere that I know of.</P> Mon, 08 Dec 2014 19:53:13 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147095#M1688 Ayn 2014-12-08T19:53:13Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147096#M1689 <P>This is not unique to Splunk. It is the nature of IP and HTTP protocols - they are stateless. So, you cannot really track a 'session' since there is none to track. Each request is treated as an independent transaction. </P> <P>More information can be found at <A href="http://en.wikipedia.org/wiki/Stateless_protocol">http://en.wikipedia.org/wiki/Stateless_protocol</A></P> Mon, 08 Jun 2015 13:19:53 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-audit-when-users-disconnect-from-Splunk/m-p/147096#M1689 dlayvand_splunk 2015-06-08T13:19:53Z