

There's no specific reason to give them different values. If you want to set the timeouts for splunkweb and splunkd to different values, you can do so by editing the configuration files, web.conf setting, and the nf setting sessionTimeout. They will continue to maintain identical values if you change the value through Splunk Web.

Initially, they share the same value of 60 minutes. This sets the user session timeout value for both the splunkweb and splunkd services.

The browser session timeout determines the maximum idle time in interaction between the user and browser. The splunkweb and splunkd timeouts determine the maximum idle time in the interaction between browser and the Splunk platform instance. The amount of time that elapses before a user session with a Splunk platform instance times out depends on the interaction among three timeout settings:Īfter the session times out, the next time the user sends a network request to the Splunk platform instance, it prompts them to log in again.
