View, edit, delete, or restore a data cube

Manage your custom data cubes by editing, deleting, or restoring the cubes.

System cubes provided by Splunk UBA can't be edited or deleted.

View and edit Splunk UBA data cubes

View existing cubes to see what's in them and make it easier to create a new one.

View more information about a system cube

Perform the following tasks to view more information about a system cube:

1. In Splunk UBA, select System > Cubes.
2. Click System Cubes.
3. In the URL, add ?system immediately following the host name or IP address. For example:

   https://uba-001.example.com/?system#Y2FzcGlkYS5jdWJlcy5jdWJlRGV0YWlsc1ZpZXc=

4. Click on a cube to view more information, including all of the attributes being aggregated in the cube.

Edit an existing custom cube

Perform the following tasks to edit an existing custom cube:

1. In Splunk UBA, select System > Cubes.
2. Click Custom Cubes.
3. Hover over the name of the cube you want to edit, then click the edit () icon.
4. Navigate through the pages in the wizard and edit the cube properties as desired. The following actions are not allowed when editing a custom cube:
   • New attributes can't be added.
   • Existing attributes can't be deleted.
   • The attribute category can't be changed.
5. Click OK to save your changes.

Delete a custom data cube

Perform the following tasks to delete a custom data cube:

1. In Splunk UBA, select System > Cubes.
2. Click Custom Cubes. You can only delete custom data cubes.
3. Hover over the cube you want to delete, and click the X icon.
4. Click OK to delete the cube. The cube is moved to the the Cubes Trash page, where you can choose to restore the cube later, or delete the cube permanently. Select the Delete cube permanently checkbox to delete the cube permanently without moving it to the Cubes Trash page. Permanently deleted cubes can't be restored.

Before a cube is deleted Splunk UBA checks to see if the cube is being used by any active or inactive models. If the cube is being used by another Splunk UBA component, an alert is displayed in Splunk UBA and the cube is not deleted.

Restore a custom data cube

Perform the following tasks to restore a custom data cube:

You can only restore custom data cubes that were not deleted permanently.

1. In Splunk UBA, select System > Cubes.
2. Click Cubes Trash.
3. Hover over the cube you want to restore, then click the gear icon to restore the cube.
4. Click OK to verify that you want to restore the selected cube.

If you already have four custom cubes active, you must move one of the active cubes to the trash before you can restore another custom cube.