Splunk Enterprise

Disconnecting from Splunk Web

mello920
Path Finder

Hello,

Does anyone have any idea why this keeps occuring? It happens to me about every 10 minutes. The session timeout is set to 60 minutes. We use SAML with Okta for authentication. I asked the Okta personnel and they said they have a 2 hour time out session. 

Disconnecting from Splunk.png

 

Any help is greatly appreciated!

V/r,

mello920

Labels (2)
0 Karma

ChrisW-TX
Loves-to-Learn

I have a similar issue to this, the exact same behavior as above for a Centrify SAML authenticated Splunk instance, however it happens at 15 minutes on the dot whether you're using the session or not.  Non-SAML Splunk Web sessions don't have this issue.  If you try to do anything in the window as shown above, like refresh, you get an ugly error from the Centrify Connector:

ChrisWTX_0-1663277333391.png

Of course we've engaged Centrify/Delinea but they aren't convinced it's not a problem on Splunk side.  I've verified Splunk is not restarting and there is no timeout or TTL setting I can find that equates to 15 minutes.  Also can't find any events concerning the disconnect in internal Splunk logs or ingested Delinea logs.

Unfortunately this behavior makes our users reluctant to rely on the SAML Sessions.

0 Karma

VatsalJagani
Champion

@mello920 - I personally have encountered this only when I'm restarting the Splunk service.

Can you please check your Splunk internal logs to see if your Splunk service is getting restarted or not?

index=_* (stop* OR start* OR clos* OR shut OR flush*)

(Please also specify host=<your-SH-host>, to improve the search.)

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...