Splunk® User Behavior Analytics

Administer Splunk User Behavior Analytics

Stop the primary system from synchronizing with the standby system

If you have a case where the standby Splunk UBA system fails, perform the following tasks to stop the primary system from trying to synchronize with the standby system:

  1. Log in to the management node of the primary Splunk UBA system as caspida.
  2. Stop all Splunk UBA services: 
    /opt/caspida/bin/Caspida stop
  3. Edit /etc/caspida/local/conf/uba-site.properties and change the replication.enabled property to false: 
    replication.enabled=false
  4. Synchronize the cluster: 
    /opt/caspida/bin/Caspida sync-cluster  /etc/caspida/local/conf
  5. Start Splunk UBA services: 
    /opt/caspida/bin/Caspida start

In cases where warm standby can't be configured, you can continue to use automated incremental backups for your Splunk UBA data. See Configure automated incremental backups in Splunk UBA.

Last modified on 01 September, 2021
Change the role of both systems to switch the primary and standby systems   Perform maintenance on your Splunk UBA clusters using warm standby

This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.4, 5.0.4.1, 5.0.5, 5.0.5.1, 5.1.0, 5.1.0.1, 5.2.0, 5.2.1, 5.3.0, 5.4.0, 5.4.1

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters