Security

Why is the Splunk user session timeout is not working?

Dev_Choudhary
Path Finder

Hi,

I have set the below in web.conf to set the user timeout session to 20 min but it's not working, any idea where is the issue:

web.conf
[settings]
tools.sessions.timeout = 10
ui_inactivity_timeout = 10

server.conf
[general]
sessionTimeout = 600s

joshualemoine
Path Finder

Same issue, similar settings, but ours is set to 15m. The timeout has not changed and still timeouts after 1 hour. The only thing worth nothing is that we are using Okta and have SAML auth enabled. So users have to MFA to get into Splunk, but I would still think the internal Splunk settings would push the user out of the web console if set per the instructions: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Configureusertimeouts

Anyone found an answer yet?

0 Karma

493669
Super Champion

HI @Dev_Choudhary,

If you are using SplunkWeb (splunkweb) to access the Splunk instance (splunkd), the smaller of the two timeout attributes prevails. So, if tools.sessions.timeout in web.conf has a value of "90" (minutes), and sessionTimeout in server.conf has a value of "1h" (1 hour; 60 minutes), the session will timeout after 60 minutes.
refer https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Configureusertimeouts

0 Karma

493669
Super Champion

I can see that you have set timeout session to 10 min and not 20 min...does it also not working for 10min?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you restart Splunk after changing the settings?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Dev_Choudhary
Path Finder

yes, by both way 1> from web console and 2> by command

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...