Splunk Enterprise

Disconnecting from Splunk Web

mello920
Path Finder

Hello,

Does anyone have any idea why this keeps occuring? It happens to me about every 10 minutes. The session timeout is set to 60 minutes. We use SAML with Okta for authentication. I asked the Okta personnel and they said they have a 2 hour time out session. 

Disconnecting from Splunk.png

 

Any help is greatly appreciated!

V/r,

mello920

Labels (2)
0 Karma

ChrisW-TX
Loves-to-Learn

I have a similar issue to this, the exact same behavior as above for a Centrify SAML authenticated Splunk instance, however it happens at 15 minutes on the dot whether you're using the session or not.  Non-SAML Splunk Web sessions don't have this issue.  If you try to do anything in the window as shown above, like refresh, you get an ugly error from the Centrify Connector:

ChrisWTX_0-1663277333391.png

Of course we've engaged Centrify/Delinea but they aren't convinced it's not a problem on Splunk side.  I've verified Splunk is not restarting and there is no timeout or TTL setting I can find that equates to 15 minutes.  Also can't find any events concerning the disconnect in internal Splunk logs or ingested Delinea logs.

Unfortunately this behavior makes our users reluctant to rely on the SAML Sessions.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@mello920 - I personally have encountered this only when I'm restarting the Splunk service.

Can you please check your Splunk internal logs to see if your Splunk service is getting restarted or not?

index=_* (stop* OR start* OR clos* OR shut OR flush*)

(Please also specify host=<your-SH-host>, to improve the search.)

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...