Splunk® User Behavior Analytics

Get Data into Splunk User Behavior Analytics

This documentation does not apply to the most recent version of Splunk® User Behavior Analytics. For documentation on the most recent version, go to the latest release.

Make changes to your HR data

Splunk UBA updates HR data daily. Because HR data is used to assign users and IDs to events processed from all other data sources, you cannot make changes to HR data once you start adding data sources.

Changing the HR data configuration after data sources are added causes duplicate user IDs to appear in Splunk UBA.

If you need to modify your HR data configuration after you have ingested events from other data sources, you must take the following steps:

  1. Remove all metadata from Splunk UBA. Run the following command: 
    /opt/caspida/bin/CaspidaCleanup dblite
    This command removes all threats, anomalies, user, and asset data, but does not remove the data sources, rules, or output connectors.
  2. Ingest and verify your HR data again. See, Get HR data into Splunk UBA.
  3. Ingest events from your data sources again.
Last modified on 24 October, 2023
Validate HR data configuration before adding other data sources   Identify assets in your environment

This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.5, 5.0.5.1, 5.1.0, 5.1.0.1, 5.2.0, 5.2.1

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters