Getting Data In

How do I increase the session timeout settings in the config files?

Mick
Splunk Employee
Splunk Employee

I've already increased this setting in web.conf, but my session still times out after an hour. Are there other settings somewhere that I need to change also?

/opt/splunk/etc/system/local/web.conf:

[settings]
tools.sessions.timeout = 480

Tags (2)
1 Solution

Mick
Splunk Employee
Splunk Employee

There are 2 main parts to Splunk, the web UI and the splunkd back-end, both of them have a timeout variable. When setting the timeout via the 'System Settings' page in 'Manager', it should update both of these settings -

$SPLUNK_HOME/etc/system/local/server.conf -

[general]
sessionTimeout = 3h

$SPLUNK_HOME/etc/system/local/web.conf -

[settings]
tools.sessions.timeout = 180

However, a bug in the current release 4.0.8 (SPL-28766) means that the incorrect web.conf setting is update, so for now a manual file-update is necessary. This should be fixed pretty soon, check out the known-issues page for confirmation - http://docs.splunk.com/Documentation/Splunk/4.0.8/ReleaseNotes/KnownIssues

View solution in original post

Mick
Splunk Employee
Splunk Employee

There are 2 main parts to Splunk, the web UI and the splunkd back-end, both of them have a timeout variable. When setting the timeout via the 'System Settings' page in 'Manager', it should update both of these settings -

$SPLUNK_HOME/etc/system/local/server.conf -

[general]
sessionTimeout = 3h

$SPLUNK_HOME/etc/system/local/web.conf -

[settings]
tools.sessions.timeout = 180

However, a bug in the current release 4.0.8 (SPL-28766) means that the incorrect web.conf setting is update, so for now a manual file-update is necessary. This should be fixed pretty soon, check out the known-issues page for confirmation - http://docs.splunk.com/Documentation/Splunk/4.0.8/ReleaseNotes/KnownIssues

FixBroken
New Member

Is there a way to grant unlimited time for specific users/groups?

0 Karma

jrodmantcell
Explorer

There is not a method to do per-group session timeouts.

Your options would entail arranging to feed those groups an already valid session token/ID and or to use something like the guestpass feature for a specific dashboard embedding purpose.

Digging further into those areas would want its own splunk answers post.

0 Karma

LewisWheeler
Communicator

Did you find a way to do this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...