Getting Data In

How do I increase the session timeout settings in the config files?

Mick
Splunk Employee
Splunk Employee

I've already increased this setting in web.conf, but my session still times out after an hour. Are there other settings somewhere that I need to change also?

/opt/splunk/etc/system/local/web.conf:

[settings]
tools.sessions.timeout = 480

Tags (2)
1 Solution

Mick
Splunk Employee
Splunk Employee

There are 2 main parts to Splunk, the web UI and the splunkd back-end, both of them have a timeout variable. When setting the timeout via the 'System Settings' page in 'Manager', it should update both of these settings -

$SPLUNK_HOME/etc/system/local/server.conf -

[general]
sessionTimeout = 3h

$SPLUNK_HOME/etc/system/local/web.conf -

[settings]
tools.sessions.timeout = 180

However, a bug in the current release 4.0.8 (SPL-28766) means that the incorrect web.conf setting is update, so for now a manual file-update is necessary. This should be fixed pretty soon, check out the known-issues page for confirmation - http://docs.splunk.com/Documentation/Splunk/4.0.8/ReleaseNotes/KnownIssues

View solution in original post

Mick
Splunk Employee
Splunk Employee

There are 2 main parts to Splunk, the web UI and the splunkd back-end, both of them have a timeout variable. When setting the timeout via the 'System Settings' page in 'Manager', it should update both of these settings -

$SPLUNK_HOME/etc/system/local/server.conf -

[general]
sessionTimeout = 3h

$SPLUNK_HOME/etc/system/local/web.conf -

[settings]
tools.sessions.timeout = 180

However, a bug in the current release 4.0.8 (SPL-28766) means that the incorrect web.conf setting is update, so for now a manual file-update is necessary. This should be fixed pretty soon, check out the known-issues page for confirmation - http://docs.splunk.com/Documentation/Splunk/4.0.8/ReleaseNotes/KnownIssues

FixBroken
New Member

Is there a way to grant unlimited time for specific users/groups?

0 Karma

jrodmantcell
Explorer

There is not a method to do per-group session timeouts.

Your options would entail arranging to feed those groups an already valid session token/ID and or to use something like the guestpass feature for a specific dashboard embedding purpose.

Digging further into those areas would want its own splunk answers post.

0 Karma

LewisWheeler
Communicator

Did you find a way to do this?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...