splunkdConnectionTimeout

[isabelcarvajal]

Hello.

I would like to ask what negative impact the following change in the folder can have?
/opt/splunk/etc/system/default/web.conf
for the splunkdConnectionTimeout parameter and leave it at 5000

[solarboyz1]

First, NEVER edit the files in the default folders. You would want to put any changes into /opt/splunk/etc/system/local/web.conf
If you edit the files in the default folders, you will loose those changes on the next upgrade/update.
Making the changes in local, means those changes will persist through upgrades/updates.

This setting in particular is the timeout when the front end web is connecting to the backend splunk process.

At a minimum, If there is an issue between the web front-end and the splunkd backend, the session will continue to try for 5000 seconds (1.3 hours) before timing out and informing the user (or whatever process was connecting via splunk web).