Community:SettingWebTimeout
From Splunk Wiki
Setting timeout limits for Splunk Web
There are three things to consider when setting your overall timeout. For most organizations, the default limit of 60 minutes is too short. In this example, we will set the web session to expire after 1 day. There are basically two components that control the UI timeout. These are the web session and the splunk session.
To set the web session timeout to 1440 minutes (1 day), edit the following setting under the [settings] stanza in your $SPLUNK_HOME/etc/system/local/web.conf file:
[settings] tools.sessions.timeout = 1440
To set the splunk session timeout to 24 hours (1 day), edit the following setting under the [general] stanza in your $SPLUNK_HOME/etc/system/local/server.conf file:
[general] sessionTimeout = 24h
See: http://docs.splunk.com/Documentation/Splunk/latest/admin/Webconf See: http://docs.splunk.com/Documentation/Splunk/latest/admin/Serverconf
Additional Considerations
You may notice that long running searches will timeout or appear dead if you let them run unattended in the UI. By default, 10 minutes of web browser inactivity will render a search inactive and will subsequently get cancelled. To ensure a search will complete, simply send it to the background or save the results. In our example below, we will set the timeout for unattended searches to 30 minutes (1800000 milliseconds). To increase the polling timeout for unattended searches in the UI, edit the following setting under the [settings] stanza in your $SPLUNK_HOME/etc/system/local/web.conf file:
[settings] poller_timeout_interval = 1800000 /// outdated, can not use in 6.X
'poller_timeout_interval' settings renamed to 'ui_inactivity_timeout' in latest Splunk.
See specs for 'ui_inactivity_timeout' in web.conf:
http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Webconf
More details about the SplunkWeb/Splunkd and ui_inactivity_timeout interactions found in the link, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configureusertimeouts