Add file-based data sources to Splunk UBA

Add new file-based data sources to Splunk UBA. You can use file-based data sources for testing on a small scale.

1. In Splunk UBA, select Manage > Data Sources.
2. Click New Data Source.
3. Select the type of data source you want to add.
4. Click Next.
5. Enter a Name to identify the data source in Splunk UBA.
6. Upload the file.
7. Click OK.

Because file-based data sources represent static data, you can write a script to create new files periodically, and then load this data into Splunk UBA.

When ingesting file-based events, Splunk UBA extracts the timestamp from events. In most cases, file-based events do not have a time zone associated with the events, so Splunk UBA uses UTC as the default time zone. If you do not want to use UTC as the time zone, perform the following tasks:

1. Log in to the management node of your Splunk UBA deployment as the caspida user.
2. Edit the /etc/caspida/local/conf/uba-site.properties file and add the parser.global.input_timezone property. For example, to set the property to Pacific Standard Time (Los Angeles):

   parser.global.input_timezone=America/Los_Angeles

3. Synchronize the cluster if you have a distributed deployment:

   /opt/caspida/bin/Caspida sync-cluster  /etc/caspida/local/conf

4. Stop and start The Splunk UBA containers:

   /opt/caspida/bin/Caspida stop-containers
   /opt/caspida/bin/Caspida start-containers