web.conf

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This is an example web.conf.  Use this file to configure data web settings.
#
# To use one or more of these configurations, copy the configuration block into web.conf 
# in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/doc/latest/admin/BundlesIntro.

[settings]
# This stanza heading must precede any changes.

# Change the default port number:

httpport = 12800

# Turn on SSL:

enableSplunkWebSSL = true
sslport  = 8080
privKeyPath = /certs/privkey.pem
caCertPath = /certs/cert.pem

# Endless Scroller configuration.  
# If you deal with almost all multiline data, you may be better served by 
# lower defaults, which mean fewer events requested at a time.

numberOfEventsPerCard = 5
numberOfCardsPerDeck = 3

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0
#
# This file contains possible attributes and values you can use to configure Splunk's web interface.
#
# There is a web.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place a web.conf in $SPLUNK_HOME/etc/system/local/.  For examples, see web.conf.example.
# You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/doc/latest/admin/BundlesIntro.

[settings]
        * Set general Splunk Web configuration options under this stanza name.
        * Follow this stanza name with any number of the following attribute/value pairs.  
        * If you do not specify an entry for each attribute, Splunk will use the default value.

startwebserver = [0 | 1]
        * Set whether or not to start Splunk Web.
        * 0 disables Splunk Web, 1 enables it.
        * Defaults to 1.

httpport = <port_number>
        * Must be present for Splunk Web to start.
        * If omitted or 0 the server will NOT start an http listener.
        * Defaults to 8000.

mgmtHostPort = <IP:port>
        * Location of splunkd.
        * Don't include http[s]:// -- just the IP address.
        * Defaults to 127.0.0.1:8089.

enableSplunkWebSSL = [True | False]
        * Toggle between http or https.
        * Set to true to enable https and SSL.
        * Defaults to False.

sslport  = <port_number>
   * Must be present for the front-end to start.
   * If omitted, or given a value of 0 the server will not start an SSL listener
   
privKeyPath = /certs/privkey.pem
caCertPath = /certs/cert.pem
   * Specify paths and names for web SSL certs.

serviceFormPostURL = http://headlamp.Splunk.com/event/add
userRegistrationURL = https://www.Splunk.com/index.php/pre_reg?destination=prod_reg
updateCheckerBaseURL = http://quickdraw.Splunk.com/js/
   * These are various Splunk.com urls that are configurable. 
   * Setting updateCheckerBaseURL to 0 will stop the Splunk Web from pinging Splunk.com 
         for new versions of itself. 

isHosted = [True | False]
        * Sets 'hosted' mode, which controls whether users can save/alter options.
        * IMPORTANT: Setting this to true is not recommended.
        * Defaults to false.

disablePersistedPrefs = <string>
        * A comma-separated list of user-types.
        * When set, prefs changes for the users will not be persisted across sessions. 
         * For example, set to <User> to disable the persistence of preferences for all 'User' type accounts.  
         * Can also be User,Power,  User,Power,Admin etc... 
        * Generally useful when many people are sharing the same account.
        * Defaults to User.

uiversion = [pinesol | oxiclean]
        * Toggle which version of Splunk Web to load.
        * Must be set to either pinesol or oxiclean. 
        * When set to pinesol, Splunk will try to start with the legacy 2.1 and 2.2 front-end.
                * Not recommended in customer installations.
                * IMPORTANT: When using the pinesol front-end with Splunk 3.0, not all features will work correctly.  

twistedLoginTimeout = <seconds_until_timeout>
        * Number of seconds before the twisted session times out.
        * After <second_until_timeout>, idle users get redirected to login. 
        * Defaults to 3600.

restApiPostMode = [none | permissive | strict]
        * Set level of checking the REST API performs on form submissions.
        * none = does not check; GET and POST are allowed.
        * permissive = warns if REST method should be accessed via POST method.
        * strict = throws error if POST-only REST method is accessed via GET.
        * Defaults to strict.

enableRestControlApi = [True | False]
        * Toggle the REST API /v3/controlapi/ endpoint on or off.
        * Defaults to false.

distributedStatusMessages
        * Configuration for various status messages that can come back from servers  in distributed search.
        * Defaults to notauthenticated:bad auth,invaliduserorpsw:bad login,down:unreachable,versionMismatch:version mismatch,productMismatch:no license,missingServerName:no server name

numberOfEventsPerCard = <integer>
        * Configuration for the number of events that the Endless Scroller asks the 
     server for with each request.
        * Defaults to 10.

numberOfCardsPerDeck = <integer>
        * Configuration for the number of requests that the Endless Scroller will 
     make before it starts to recycle space occupied by prior pages.
        * Defaults to 7.

appLoggingLevel = [DEBUG | INFO | WARNING | ERROR | CRITICAL]
   * Set the logging level for the python appserver.
   * The output is separate from the main splunkd logs.
   * Writes to $SPLUNK_HOME/var/log/splunk/web_service.log
   * Defaults to INFO.
     
compressStaticFiles = [True | False]
   * Indicates if the static JS, CSS, XSL files are condensed or consolidated.
   * Enable to improve client-side performance.  
   * Defaults to True.

# Configuration options for the administration section of Splunk Web

[adminTabs]
        * Configure the order and appearance of Splunk Web's tabs under this stanza name.
        * Follow this stanza name with any number of the following attribute/value pairs.  
        * If you do not specify an entry for each attribute, Splunk will use the default value.

_order = <string>
        * Comma-separated values of tab paths. 
        * Controls the order of the tabs in Splunk Web.
        * Defaults to settings,datainputs,indexmanager,apps,distributed,users,saved,license

<pathToAdminSection>_label = <string>
        * Set the label on the tab that appears in Splunk Web.
        * Map from _order.
        * Defaults are:
                apps_label = Applications
        settings_label = Server
                datainputs_label = Data Inputs
        distributed_label = Distributed
        indexmanager_label = Indexes
        users_label = Users
        saved_label = Saved Searches
        license_label = License & Usage

<pathToAdminSection>_capabilities = <string>
        * Comma-separated list that maps the tabs in Splunk Web to roles.
        * Tab will only appear for users in one of those roles.
        * NOTE: For non-admin users there is a special tab called 'my account' that 
         appears, and that tab is not configurable here.
        * Defaults to:
                apps_capabilities = edit_applications
                settings_capabilities = server_settings_tab,server_control_tab,server_auth_config_tab
                datainputs_capabilities = edit_input,delete_input,edit_sourcetype,edit_tail,edit_tcp,edit_udp,edit_watch
                distributed_capabilities = distributed_all_tab,distributed_receive_tab,distributed_forward_tab,distributed_search_tab
                indexmanager_capabilities = edit_index
                users_capabilities = edit_user,user_tab
                saved_capabilities = save_global_search,save_local_search,delete_local_search,schedule_search,edit_local_search,edit_role_search,edit_saved_search,savedsearch_tab
                license_capabilities = license_tab

# Configuration options for the LiveTail section of Splunk Web
                
[livetail]

buffer_max_size = <integer>
        * Max size of stream events, items will be dropped after this limit is reached.
        * Defaults to 4000.

update_interval = <integer>
        * Delay in milliseconds before updating the UI with a stream event.
        * Defaults to 200.

multiple = <True | False>
        * WARNING! enabling multiple live tails with improper browser configuration may make splunk web to appear to be not working.
        * Please ensure HTTP pipelining http://en.wikipedia.org/wiki/HTTP_pipelining is enabled.
        * See http://www.freerepublic.com/focus/f-news/1299854/posts for firefox configuration.
        * Defaults to False.