Splunk® User Behavior Analytics

Administer Splunk User Behavior Analytics

Perform maintenance on your Splunk UBA clusters using warm standby

When maintenance is required, you can perform that maintenance without disrupting replication, and with minimal impact to your UBA environment and users.

Follow these steps for both primary and/ or standby systems:

  1. Check replication table and logs to ensure replication is active and same cycle ids:
    1. Postgres node: psql -d caspidadb -c 'select * from replication'
    2. Splunk UBA management node:tail -f /var/log/caspida/replication/replication.log

    In 20-node clusters, Postgres services run on node 2 instead of node 1.

  2. Stop all Splunk UBA services on management node of Standby UBA system:
    /opt/caspida/bin/Caspida stop-all
  3. Perform maintenance on the affected node.

    Complete this task as soon as possible, ideally in less than four hours.

  4. Start all Splunk UBA services on management node of standby UBA system:
    1. For primary systems: /opt/caspida/bin/Caspida start-all
    2. For standby systems: /opt/caspida/bin/Caspida start-all --no-caspida
  5. Check replication table and logs to ensure replication is still active and same cycle ids:
    1. Postgres node: psql -d caspidadb -c 'select * from replication'
    2. Splunk UBA management node: tail -f /var/log/caspida/replication/replication.log

    In 20-node clusters, Postgres services run on node 2 instead of node 1.

Last modified on 25 March, 2024
Stop the primary system from synchronizing with the standby system   Clean up the standby system if you accidentally started Splunk UBA services

This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.4.1, 5.0.5, 5.0.5.1, 5.1.0, 5.1.0.1, 5.2.0, 5.2.1, 5.3.0, 5.4.0, 5.4.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters