Community:SettingWebTimeout

Setting timeout limits for Splunk Web

There are three things to consider when setting your overall timeout. For most organizations, the default limit of 60 minutes is too short. In this example, we will set the web session to expire after 1 day. There are basically two components that control the UI timeout. These are the web session and the splunk session.

To set the web session timeout to 1440 minutes (1 day), edit the following setting under the [settings] stanza in your $SPLUNK_HOME/etc/system/local/web.conf file:

[settings]
tools.sessions.timeout = 1440 

To set the splunk session timeout to 24 hours (1 day), edit the following setting under the [general] stanza in your $SPLUNK_HOME/etc/system/local/server.conf file:

[general]
sessionTimeout = 24h 

See: http://docs.splunk.com/Documentation/Splunk/latest/admin/Webconf See: http://docs.splunk.com/Documentation/Splunk/latest/admin/Serverconf

Additional Considerations

You may notice that long running searches will timeout or appear dead if you let them run unattended in the UI. By default, 10 minutes of web browser inactivity will render a search inactive and will subsequently get cancelled. To ensure a search will complete, simply send it to the background or save the results. In our example below, we will set the timeout for unattended searches to 30 minutes (1800000 milliseconds). To increase the polling timeout for unattended searches in the UI, edit the following setting under the [settings] stanza in your $SPLUNK_HOME/etc/system/local/web.conf file:

[settings]
poller_timeout_interval = 1800000  /// outdated, can not use in 6.X

'poller_timeout_interval' settings renamed to 'ui_inactivity_timeout' in latest Splunk.

See specs for 'ui_inactivity_timeout' in web.conf:

http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Webconf

More details about the SplunkWeb/Splunkd and ui_inactivity_timeout interactions found in the link, http://docs.splunk.com/Documentation/Splunk/latest/Admin/Configureusertimeouts