Verify that you successfully added the data source
Confirm that the data source you added is successfully parsing events.
- In Splunk UBA, select Manage > Data Sources.
- Click the name of the data source that you added.
- Review the Data Source Details.
- Click the parsed events icon () and review the 10 sample events. Make sure that each event lists event views.
There are times when some data sources, such as DHCP, DNS, AD, or HTTP do not provide a destination device. If you ingest one of these data types and see validation error messages, you can ignore these messages once you examine the raw event and validate the absence of the destination device in the raw event.
Configure the VirusTotal script to see VirusTotal anomalies in Splunk UBA | Monitor the quality of data sent from the Splunk platform |
This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.4.1, 5.0.5, 5.0.5.1, 5.1.0, 5.1.0.1
Feedback submitted, thanks!