# Version 9.2.2.20240415 # # This file contains possible attributes and values you can use to configure # the Splunk Web interface. # # There is a web.conf in $SPLUNK_HOME/etc/system/default/. To set custom # configurations, place a web.conf in $SPLUNK_HOME/etc/system/local/. For # examples, see web.conf.example. You must restart Splunk software to enable # configurations. # # To learn more about configuration files (including precedence) please see # the documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles [settings] * Set general Splunk Web configuration options under this stanza name. * Follow this stanza name with any number of the following setting/value pairs. * If you do not specify an entry for each setting, Splunk Web uses the default value. startwebserver = [0 | 1] * Set whether or not to start Splunk Web. * 0 disables Splunk Web, 1 enables it. * Default: 1 httpport = * The TCP port on which Splunk Web listens for incoming connections. * Must be present for Splunk Web to start. * If omitted or 0 the server will NOT start an http listener. * If using SSL, set to the HTTPS port number. * Default: 8000 mgmtHostPort = * The host port of the splunkd process. * The IP address and host port where Splunk Web looks for the splunkd process. * The port listens on all avalible host IP addresses (0.0.0.0) * Don't include "http[s]://" when specifying this setting. Only include the IP address and port. * Default (on universal forwarders): localhost:8089 * Default (on all other Splunk platform instance types): 0.0.0.0:8089 appServerPorts = [, , ...] * Port number(s) for the python-based application server to listen on. This port is bound only on the loopback interface -- it is not exposed to the network at large. * Generally, you should only set one port number here. For most deployments a single application server won't be a performance bottleneck. However you can provide a comma-separated list of port numbers here and splunkd will start a load-balanced application server on each one. * At one time, setting this to zero indicated that the web service should be run in a legacy mode as a separate service, but as of Splunk 8.0 this is no longer supported. * Default: 8065 splunkdConnectionTimeout = * The amount of time, in seconds, to wait before timing out when communicating with splunkd. * Must be at least 30. * Values smaller than 30 will be ignored, resulting in the use of the default value * Default: 30 enableSplunkWebClientNetloc = * Control if the Splunk Web client can override the client network location. * Default: false enableSplunkWebSSL = * Toggle between http or https. * Set to true to enable https and SSL. * Default: false privKeyPath = * The path to the file containing the web server SSL certificate private key. * A relative path is interpreted relative to $SPLUNK_HOME and may not refer outside of $SPLUNK_HOME (e.g., no ../somewhere). * You can also specify an absolute path to an external key. * See also 'enableSplunkWebSSL' and 'serverCert'. * Default: $SPLUNK_HOME/etc/auth/splunkweb/privkey.pem serverCert = * Full path to the Privacy Enhanced Mail (PEM) format Splunk web server certificate file. * The file may also contain root and intermediate certificates, if required. They should be listed sequentially in the order: [ Server SSL certificate ] [ One or more intermediate certificates, if required ] [ Root certificate, if required ] * See also 'enableSplunkWebSSL' and 'privKeyPath'. * Default: $SPLUNK_HOME/etc/auth/splunkweb/cert.pem sslPassword = * Password that protects the private key specified by 'privKeyPath'. * If encrypted private key is used, do not enable client-authentication on splunkd server. In [sslConfig] stanza of server.conf, 'requireClientCert' must be 'false'. * Optional. * Default: The unencrypted private key. caCertPath = * DEPRECATED. * Use 'serverCert' instead. * A relative path is interpreted relative to $SPLUNK_HOME and may not refer outside of $SPLUNK_HOME (e.g., no ../somewhere). * No default. sslRootCAPath = * The path to a root certificate authority (CA) certificate, in privacy-enhanced mail (PEM) format, that splunkd is to use to authenticate client certificates under certain specific conditions. * Splunkd uses the certificate specified at the path defined in this setting only when both 'requireClientCert' and 'enableCertBasedUserAuth' have a value of "true". * If this setting has no value, splunkd falls back to the value of the 'sslRootCAPath' setting in server.conf. * If you have already configured 'sslRootCAPath' in server.conf, the value of this setting does not override the setting of the same name in server.conf. * No default. enableCertBasedUserAuth = * Whether or not user authentication with certificates is enabled. * When certificate-based authentication is enabled, splunkd uses a digital certificate to identify and grant a user access to a Splunk platform instance resource. * A value of "true" means that splunkd uses certificates for authentication. * When this setting has a value of "true", 'requireClientCert' must *also* have a value of "true". * A value of "false" means that splunkd does not use certificates for authentication. * NOTE: Splunkd disables the check to determine if Splunk Web is serving web requests after it completes startup when this setting has a value of "true". If you need this check to happen, then this setting *must* have a value of "false". * Default: false certBasedUserAuthMethod = * The method that the Splunk platform uses to extract LDAP credentials from client certificates. * This setting takes one of the following values: * CommonName: Use the value contained in the Common Name field of a client certificate in its entirety * EDIPI (Electronic Data Interchange Personal Identifier): Extract the EDIPI, the 10-digit numeric identifier from the Common Name. If the platform can't find the EDIPI, then it uses the Common Name in its entirety. * PIV (Personal Identity Verification): Use PIV, a 16-digit numeric identifier typically formatted as xxxxxxxxxxxxxxxx@mil. It is extracted from an "Other Name" field in the Subject Alternate Name which corresponds to one of the object identifiers (OIDs) that you configure in 'certBasedUserAuthPivOidList'. * No default. certBasedUserAuthPivOidList = * A list of object identifiers (OIDs) that the Splunk platform uses to lookup an end-user's PIV info in the Subject Alternate Name extension of the client certificate. * The Splunk platform queries OIDs sequentially in a client certificate until it finds an OID with a value. * The value contained in the matched OID is then used to authenticate the user. * Default: 1.3.6.1.4.1.311.20.2.3, Microsoft Universal Principal Name requireClientCert = * Whether or not an HTTPS client that connects to the Splunk Web HTTPS server must present a certificate that was signed by the same certificate authority (CA) that signed the certificate that was installed on this instance. * A value of "true" means the following: * A client can connect *only* if it presents a certificate that was created and signed by the same CA that created the certificate that the instance uses * You must configure splunkd with the same root CA in the server.conf file. This requirement ensures proper communication between splunkd and Splunk Web. * If you give 'enableCertBasedUserAuth' a value of "true", then the previous statements do not apply. Instead, the instance uses the root CA certificate defined in the 'sslRootCAPath' setting in web.conf, and if no certificate path is defined in that file, it then uses the certificate defined in the 'sslRootCAPath' setting in server.conf. * A value of "false" means that clients do not need to present a certificate to connect to the instance. * Default: false sslCommonNameToCheck = , , ... * Checks the common name of the client's certificate against this list of names. * 'requireClientCert' must be set to "true" for this setting to work. * Optional. * Default: empty string (No common name checking). sslAltNameToCheck = , , ... * If this value is set, and 'requireClientCert' is set to true, Splunk Web will verify certificates which have a so-called "Subject Alternate Name" that matches any of the alternate names in this list. * Subject Alternate Names are effectively extended descriptive fields in SSL certs beyond the commonName. A common practice for HTTPS certs is to use these values to store additional valid hostnames or domains where the cert should be considered valid. * Accepts a comma-separated list of Subject Alternate Names to consider valid. * Optional. * Default: empty string (no alternate name checking). serviceFormPostURL = http://docs.splunk.com/Documentation/Splunk * DEPRECATED. * This setting has been deprecated since Splunk Enterprise version 5.0.3. userRegistrationURL = https://www.splunk.com/page/sign_up updateCheckerBaseURL = http://quickdraw.Splunk.com/js/ docsCheckerBaseURL = http://quickdraw.splunk.com/help * These are various Splunk.com urls that are configurable. * Setting 'updateCheckerBaseURL' to 0 stops Splunk Web from pinging Splunk.com for new versions of Splunk software. enable_insecure_login = * Whether or not the GET-based "/account/insecurelogin" REST endpoint is enabled. * Provides an alternate GET-based authentication mechanism. * If "true", the following url is available: http://localhost:8000/en-US/account/insecurelogin?loginType=splunk&username=noc&password=XXXXXXX * If "false", only the main /account/login endpoint is available * Default: false enable_secure_entity_move = * Whether or not you can perform an HTTP GET request on the "move" REST endpoint for any entity that has such an endpoint, to move that entity from one Splunk app to another. * Entities are configurable components of the Splunk Web framework, such as views, styles, and drilldown actions. This is not an exhaustive list. * If set to "true", you can perform only HTTP POST requests against the "move" endpoint for an entity. * For example, if you have an endpoint "/en_US/manager/launcher/data/ui/views/move", you can only perform an HTTP POST request to access that endpoint to move an entity from one app to another. * If set to "false", you can perform both HTTP GET and POST requests against the "move" endpoint of an entity. * Default: true enable_insecure_pdfgen = * Whether or not the "/services/pdfgen/render" REST endpoint allows GET requests. * If "true", allows PDFs to be generated using GET or POST requests. * If "false", only allows PDFs to be generated using POST requests. * Default: false simple_error_page = * Whether or not to display a simplified error page for HTTP errors that only contains the error status. * If set to "true", Splunk Web displays a simplified error page for errors (404, 500, etc.) that only contain the error status. * If set to "false", Splunk Web displays a more verbose error page that contains the home link, message, a more_results_link, crashes, referrer, debug output, and byline * Default: false login_content = * Lets you add custom content to the login page. * Supports any text including HTML. * No default. sslVersions = * A comma-separated list of SSL versions to support. * The versions available are "ssl3", "tls1.0", "tls1.1", and "tls1.2" * The special version "*" selects all supported versions. The version "tls" selects all versions tls1.0 or newer * If you prefix a version with "-", it is removed from the list. * SSLv2 is always disabled; "-ssl2" is accepted in the version list, but does nothing. * When configured in FIPS mode, "ssl3" is always disabled regardless of this configuration. * For the default, see $SPLUNK_HOME/etc/system/default/web.conf. supportSSLV3Only = * This setting is DEPRECATED. SSLv2 is now always disabled. The exact set of SSL versions allowed is now configurable via the 'sslVersions' setting above. cipherSuite = * If set, uses the specified cipher string for the HTTP server. * If not set, uses the default cipher string provided by OpenSSL. This is used to ensure that the server does not accept connections using weak encryption protocols. * Must specify 'dhFile' to enable any Diffie-Hellman ciphers. * The default can vary. See the cipherSuite setting in * $SPLUNK_HOME/etc/system/default/web.conf for the current default. ecdhCurveName = * DEPRECATED. * Use the 'ecdhCurves' setting instead. * This setting specifies the Elliptic Curve Diffie-Hellman (ECDH) curve to use for ECDH key negotiation. * Splunk only supports named curves that have been specified by their SHORT name. * The list of valid named curves by their short and long names can be obtained by running this CLI command: $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves * Default: empty string. ecdhCurves = * A list of ECDH curves to use for ECDH key negotiation. * The curves should be specified in the order of preference. * The client sends these curves as a part of an SSL Client Hello. * The server supports only the curves specified in the list. * Splunk software only supports named curves that have been specified by their SHORT names. * The list of valid named curves by their short and long names can be obtained by running this CLI command: $SPLUNK_HOME/bin/splunk cmd openssl ecparam -list_curves * Example setting: "ecdhCurves = prime256v1,secp384r1,secp521r1" * The default can vary. See the 'ecdhCurves' setting in $SPLUNK_HOME/etc/system/default/web.conf for the current default. dhFile = * Full path to the Diffie-Hellman parameter file. * Relative paths are interpreted as relative to $SPLUNK_HOME, and must not refer to a location outside of $SPLUNK_HOME. * This file is required in order to enable any Diffie-Hellman ciphers. * Default: not set. root_endpoint = * Defines the root URI path on which the appserver will listen * For example, if you want to proxy the splunk UI at http://splunk:8000/splunkui, then set root_endpoint = /splunkui * Default: / static_endpoint = * Path to static content. * The path here is automatically appended to root_endpoint defined above * Default: /static static_dir = * The directory that holds the static content * This can be an absolute URL if you want to put it elsewhere * Default: share/splunk/search_mrsparkle/exposed rss_endpoint = * Path to static rss content * The path here is automatically appended to what you defined in the 'root_endpoint' setting * Default: /rss embed_uri = * Optional URI scheme/host/port prefix for embedded content * This presents an optional strategy for exposing embedded shared content that does not require authentication in a reverse proxy/single sign on environment. * Default: empty string, resolves to the client window.location.protocol + "//" + window.location.host embed_footer = * A block of HTML code that defines the footer for an embedded report. * Any valid HTML code is acceptable. * Default: "splunk>" tools.staticdir.generate_indexes = [1 | 0] * Whether or not the webserver serves a directory listing for static directories. * Default: 0 (false) template_dir = * The base path to the Mako templates. * Default: "share/splunk/search_mrsparkle/templates" module_dir = * The base path to Splunk Web module assets. * Default: "share/splunk/search_mrsparkle/modules" enable_gzip = * Whether or not the webserver applies gzip compression to responses. * Default: true use_future_expires = * Whether or not the Expires header of /static files is set to a far-future date * Default: true flash_major_version = * DEPRECATED. flash_minor_version = * DEPRECATED. flash_revision_version = * DEPRECATED. * Specifies the minimum Flash plugin version requirements * Flash support, broken into three parts. * We currently require a min baseline of Shockwave Flash 9.0 r124 override_JSON_MIME_type_with_text_plain = * Whether or not to override the MIME type for JSON data served up by Splunk Web endpoints with content-type="text/plain; charset=UTF-8" * If "true", Splunk Web endpoints (other than proxy) that serve JSON data will serve as "text/plain; charset=UTF-8" * If "false", Splunk Web endpoints that serve JSON data will serve as "application/json; charset=UTF-8" enable_proxy_write = * Indicates if the /splunkd proxy endpoint allows POST operations. * If "true", both GET and POST operations are proxied through to splunkd. * If "false", only GET operations are proxied through to splunkd. * Setting to "false" prevents many client-side packages (such as the Splunk JavaScript SDK) from working correctly. * Default: true js_logger_mode = [None | Firebug | Server] * The JavaScript Logger mode. * Available modes: None, Firebug, Server * Mode None: Does not log anything. * Mode Firebug: Use firebug by default if it exists, or defer to the older less promiscuous version of firebug lite. * Mode Server: Log to a defined server endpoint. * See js/logger.js Splunk.Logger.Mode for mode implementation details and if you would like to author your own. * Default: None js_logger_mode_server_end_point = * The server endpoint to post JavaScript log messages * Used when js_logger_mode = Server * Default: util/log/js js_logger_mode_server_poll_buffer = * The interval, in milliseconds, to check, post, and cleanse the JavaScript log buffer * Default: 1000 js_logger_mode_server_max_buffer = * The maximum size threshold, in megabytes, to post and cleanse the JavaScript log buffer * Default: 100 ui_inactivity_timeout = * The length of time lapsed, in minutes, for notification when there is no user interface clicking, mouseover, scrolling, or resizing. * Notifies client side pollers to stop, resulting in sessions expiring at the 'tools.sessions.timeout' value. * If less than 1, results in no timeout notification ever being triggered (Sessions stay alive for as long as the browser is open). * Default: 60 js_no_cache = * DEPRECATED. * Toggles the JavaScript cache control. * Default: false cacheBytesLimit = * Splunkd can keep a small cache of static web assets in memory. When the total size of the objects in cache grows larger than this setting, in bytes, splunkd begins ageing entries out of the cache. * If set to zero, disables the cache. * Default: 4194304 cacheEntriesLimit = * Splunkd can keep a small cache of static web assets in memory. When the number of the objects in cache grows larger than this, splunkd begins ageing entries out of the cache. * If set to zero, disables the cache. * Default: 16384 staticCompressionLevel = * Splunkd can keep a small cache of static web assets in memory. Splunkd stores these assets in a compressed format, and the assets can usually be served directly to the web browser in compressed format. * This level can be a number between 1 and 9. Lower numbers use less CPU time to compress objects, but the resulting compressed objects will be larger. * There is not much benefit to decreasing the value of this setting from its default. Not much CPU time is spent compressing the objects. * Default: 9 enable_autocomplete_login = * Indicates if the main login page lets browsers autocomplete the username. * If "true", browsers may display an autocomplete drop down in the username field. * If "false", browsers may not show autocomplete drop down in the username field. * Default: false verifyCookiesWorkDuringLogin = * Normally, the login page makes an attempt to see if cookies work properly in the user's browser before allowing them to log in. * If you set this to "false", this check is skipped. * Do not set to "false" in normal operations. * Default: true minify_js = * Whether or not the static JavaScript files for modules are consolidated and minified. * A value of "true" means that JavaScript files for modules are consolidated and minified. This improves client-side performance by reducing the number of HTTP requests and the size of HTTP responses. * A value of "false" means that JavaScript files for modules are not consolidated or minified. * Default: true minify_css = * Whether or not the static CSS files for modules are consolidated and minified. * A value of "true" means that static CSS files for modules are consolidated and minified. This improves client-side performance by reducing the number of HTTP requests and the size of HTTP responses. * A value of "false" means that static CSS files for modules are not consolidated or minified. * Due to browser limitations, setting this to "false" when using Internet Explorer version 9 and lower might result in display problems. * Default: true trap_module_exceptions = * Whether or not the JavaScript for individual modules is wrapped in a try/catch * If "true", syntax errors in individual modules do not cause the UI to hang, other than when using the module in question. * Set to "false" when developing apps. enable_pivot_adhoc_acceleration = * DEPRECATED in version 6.1 and later, use 'pivot_adhoc_acceleration_mode' instead * Whether or not the pivot interface uses its own ad-hoc acceleration when a data model is not accelerated. * If "true", the pivot interface uses ad-hoc acceleration to make reporting in pivot faster and more responsive. * In situations where data is not stored in time order, or where the majority of events are far in the past, disabling this behavior can improve the pivot experience. pivot_adhoc_acceleration_mode = [Elastic | AllTime | None] * Specifies the type of ad-hoc acceleration used by the pivot interface when a data model is not accelerated. * If "Elastic", the pivot interface only accelerates the time range specified for reporting, and dynamically adjusts when this time range is changed. * If "AllTime", the pivot interface accelerates the relevant data over all time. This makes the interface more responsive to time-range changes but places a larger load on system resources. * If "None", the pivot interface does not use any acceleration. This means any change to the report requires restarting the search. * Default: Elastic jschart_test_mode = * Whether or not the JSChart module runs in Test Mode. * If "true", JSChart module attaches HTML classes to chart elements for introspection. * This negatively impacts performance and should be disabled unless you are actively using JSChart Test Mode. # # To avoid browser performance impacts, the JSChart library limits # the amount of data rendered in an individual chart. jschart_truncation_limit = * Cross-broswer truncation limit. * If set, takes precedence over the browser-specific limits below jschart_truncation_limit.chrome = * Chart truncation limit. * For Chrome only. * Default: 50000 jschart_truncation_limit.firefox = * Chart truncation limit. * For Firefox only. * Default: 50000 jschart_truncation_limit.safari = * Chart truncation limit. * For Safari only. * Default: 50000 jschart_truncation_limit.ie11 = * Chart truncation limit. * For Internet Explorer version 11 only * Default: 50000 jschart_series_limit = * Chart series limit for all browsers. * Default: 100 jschart_results_limit = * DEPRECATED. * Use 'data_sources.primary.params.count' in visualizations.conf instead. * Chart results per series limit for all browsers. * Overrides the results per series limit for individual visualizations. * Default: 10000 choropleth_shape_limit = * Choropleth map shape limit for all browsers. * Default: 10000 dashboard_html_allow_inline_styles = * Whether or not to allow style attributes from inline HTML elements in dashboards. * If "false", style attributes from inline HTML elements in dashboards will be removed to prevent potential attacks. * Default: true dashboard_html_allow_embeddable_content = * Whether or not to allow and