How to search for session timeout event in Splunk internal logs for an account? ... is there any way to find the entries for session timeout? I have already tried index=_internal OR index=_audit host=* user="*" "*logged*" OR "*timed*" OR *session* OR *logout* OR *login* only results related to login and user-initiated logouts. Nothing related to session timeouts due to user inactivity. Basically I am trying to debug an account behavior on Splunk Enterprise... we are having two systems and on both we are using same account to login into Splunk web. As per the below documentation for session timeouts: http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Configureusertimeouts due to user inactivity and configurations for splunkweb and splunkd session timeout the account should timeout in 60mins. Now on both systems we are displaying 2 dashboards with autorefresh on &ltform refresh="60"&gt but one dashboard still timesout and the other continues to work without timing out to Splunk login page. ... View more