Splunk UBA deployment architecture
To scale Splunk User Behavior Analytics (UBA) in a distributed deployment, specific tasks are assigned to each physical server, or node, in a cluster. Each node then has specific services installed to support that task. The specific services installed on each node can vary depending on the size of your cluster. For example, in a 7-node deployment, Spark services are installed on node 7 only, while Hadoop services are installed on all nodes except for node 3.
- See Monitor the health of your Splunk UBA deployment in Administer Splunk User Behavior Analytics for more information about each type of service.
- See Where services run in Splunk UBA in Administer Splunk User Behavior Analytics for more information about finding where services are running in your Splunk UBA deployment.
In a single-node deployment, all services provided by the streaming and batch servers exist on the same node.
All nodes in your Splunk UBA deployment must meet the System requirements for Splunk UBA.
|Management server||The management server hosts the Splunk UBA web interface. You only need one management server.
|Streaming server||Streaming servers are logical servers consisting of a collection of related streaming processes. A streaming server can exist on any single Splunk UBA node or across multiple nodes.
|Batch server||Batch servers are logical servers consisting of a collection of related batch processes. A batch server can exist on any single Splunk UBA node or across multiple nodes.
About Splunk User Behavior Analytics
Scaling your Splunk UBA deployment
This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.5, 22.214.171.124, 5.1.0, 126.96.36.199, 5.2.0
Feedback submitted, thanks!