Why is the Splunk user session timeout is not working?

[Dev_Choudhary]

Hi,

I have set the below in web.conf to set the user timeout session to 20 min but it's not working, any idea where is the issue:

web.conf
[settings]
tools.sessions.timeout = 10
ui_inactivity_timeout = 10

server.conf
[general]
sessionTimeout = 600s

[joshualemoine]

Same issue, similar settings, but ours is set to 15m. The timeout has not changed and still timeouts after 1 hour. The only thing worth nothing is that we are using Okta and have SAML auth enabled. So users have to MFA to get into Splunk, but I would still think the internal Splunk settings would push the user out of the web console if set per the instructions: https://docs.splunk.com/Documentation/Splunk/8.0.1/Admin/Configureusertimeouts

Anyone found an answer yet?

[493669]

HI @Dev_Choudhary,

If you are using SplunkWeb (splunkweb) to access the Splunk instance (splunkd), the smaller of the two timeout attributes prevails. So, if tools.sessions.timeout in web.conf has a value of "90" (minutes), and sessionTimeout in server.conf has a value of "1h" (1 hour; 60 minutes), the session will timeout after 60 minutes.
refer https://docs.splunk.com/Documentation/Splunk/7.0.2/Admin/Configureusertimeouts

[493669]

I can see that you have set timeout session to 10 min and not 20 min...does it also not working for 10min?

[richgalloway]

Did you restart Splunk after changing the settings?

[Dev_Choudhary]

yes, by both way 1> from web console and 2> by command