Make changes to your HR data
Splunk UBA updates HR data daily. Because HR data is used to assign users and IDs to events processed from all other data sources, you cannot make changes to HR data once you start adding data sources. Changing the HR data configuration after data sources are added causes duplicate user IDs to appear in Splunk UBA. If you need to modify your HR data configuration after you have ingested events from other data sources, you must do the following:
- Remove all metadata from Splunk UBA.
- Ingest and verify your HR data again.
- Ingest events from your data sources again.
Validate HR data configuration before adding other data sources | Identify assets in your environment |
This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.4.1
Feedback submitted, thanks!