Getting Data In

How to search for session timeout event in Splunk internal logs for an account?

varun8159
Explorer

How to search for session timeout event in Splunk internal logs for an account?
... is there any way to find the entries for session timeout?

I have already tried

index=_internal OR index=_audit host=* user="*" "*logged*" OR "*timed*" OR *session* OR *logout* OR *login*

only results related to login and user-initiated logouts. Nothing related to session timeouts due to user inactivity.

Basically I am trying to debug an account behavior on Splunk Enterprise... we are having two systems and on both we are using same account to login into Splunk web. As per the below documentation for session timeouts:
http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Configureusertimeouts

due to user inactivity and configurations for splunkweb and splunkd session timeout the account should timeout in 60mins. Now on both systems we are displaying 2 dashboards with autorefresh on
&ltform refresh="60"&gt
but one dashboard still timesout and the other continues to work without timing out to Splunk login page.

Tags (3)
0 Karma

Azeemering
Builder

Depending if you have configured forwarding your internal logs from the Search Heads to the indexer(s);
index=_internal sourcetype=splunk_web_service reason="session-timeout"

0 Karma

varun8159
Explorer

yes they are configured but this reason="session-timeout" doesn't seem to be appearing in the list of reasons.

0 Karma

adonio
Ultra Champion

what are you trying to solve here? iirc splunk does not log the logout action or if you close the browser for example.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...