Configuring Web Session Timeout for Enhanced Security in Splunk Cloud.

Available Languages

Updated:September 29, 2026
Document ID:SPLK048453

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise

Description

In Splunk, web session timeouts are set up to log out users after a certain period of inactivity automatically. 
The session timeout is 60 minutes by default, but it can be adjusted to meet specific security requirements.

Splunk provides the option to customize session timeouts through the web.conf and server.conf configuration files, as well as browser settings. These parameters play a crucial role in managing user sessions and safeguarding sensitive data.

It is important to note that the session timeout settings are interrelated, with the shortest value between Splunkweb and Splunkd being prioritized.


Investigation

Session timeout behavior in Splunk cloud is determined by a combination of the following configuration settings: 
 
- splunkweb : Defined under setting in the `web.conf` file.

- splunkd : Defined under the `sessionsTimeout` setting in the `server.conf` file.

- Browser timeout : Managed by the `ui_inactivity_timeout` setting in the `web.conf` file.
 
When the timeout values differ between splunkweb and splunkd, the lower value takes precedence.

For instance, if splunkweb is set to 10 minutes and ui_inactivity_timeout is set to 5 minutes, the total session timeout will be limited to 15 minutes.
 
Configuration values can be verified using the following Splunk CLI commands: Or if you are a SplunkCloud user, you can utilize the Admins Little Helper for Splunk application from splunkbase to utilize GUI-based btool commands;

Access the Search Head through CLI and modify the configuration files as below : (If a SplunkCloud user, raise a support case to tune the configuration)

web.conf     : 
                      /opt/splunk/etc/apps/100-whisper-searchhead/local/web.conf
                      tools.sessions.timeout = 5

server.conf  :
                   /opt/splunk/etc/apps/100-whisper-searchhead/local/web.conf
                   ui_inactivity_timeout = 10 

 


Resolution

To set the desired session timeout, modify the following settings in the respective configuration files for session time out in 15 minutes.
Access Search head through CLI, add the following in the mentioned configuration.

web.conf     :

                      ~$ splunk btool web list settings --debug | grep "tools.sessions.timeout"
                       /opt/splunk/etc/apps/100-whisper-searchhead/local/web.conf
                     tools.sessions.timeout = 5

server.conf :
                    ~$ splunk btool web list settings --debug | grep "ui_inactivity_timeout"
                    /opt/splunk/etc/apps/100-whisper-searchhead/local/web.conf
                   ui_inactivity_timeout = 10

Ensure the configured values align with the desired session timeout across the Splunk environment. 

Splunk Cloud users can Submit support ticket to make desired  changes.

https://docs.splunk.com/Documentation/Splunk/9.3.2/Admin/Configureusertimeouts

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles