Install Splunk User Behavior Analytics

Install Splunk UBA with assistance from Splunk Professional Services.

Installing Splunk UBA on hardened operating systems is not supported.

You can install Splunk UBA in a single-server deployment or in a distributed deployment of 3, 5, 7, 10, or 20 servers. All servers must meet the system requirements. See System requirements for Splunk UBA in this manual. For a distributed deployment, review the deployment planning and scaling guide. See Plan and scale your Splunk UBA deployment in the Plan and Scale your Splunk UBA Deployment manual.

The AMI installation option is temporarily delayed, and expected to be available 30 days post 5.1.0 release.

On December 31, 2021, Red Hat's CentOS Linux reached End Of Life (EOL). Per Red Hat, Inc, CentOS Linux users must migrate to a new operating system to continue receiving updates, patches, and new features. Red Hat also encourages customers to migrate to RHEL. Additionally, Red Hat made the new "CentOS Stream" operating system a non-production, pre-build version of RHEL, with no long-term support model. Splunk UBA does not include CentOS Stream as a supported operating system. Customers must migrate to and adopt a supported production Linux distro of RHEL, Ubuntu, or OEL as a base OS for UBA version 5.1.0.

• Install Splunk UBA on a single Linux server.
• Install Splunk UBA on several Linux servers.