Verify a successful upgrade of Splunk UBA

After upgrading Splunk UBA, verify a successful upgrade.

Verify data sources

Verify all the data sources that were processing before the upgrade are running and processing data.

1. Log in to Splunk UBA in a web browser.
2. From the Splunk UBA toolbar, select Manage > Data Sources.
3. Verify that data sources are processing data and EPS is not zero.

Remove Postgres 10

UBA version 5.3.0 upgrades Postgres from version 10 to version 15. After validating that your upgrade is successful, you can safely remove Postgres 10 and reclaim space using the steps for your operating system.

For Redhat and OEL

1. Remove the Postgres packages from the host:

   sudo yum remove postgresql10-* -y

2. Remove the old Postgres data directory:

   This step only removes the data directory of the old Postgres version /var/lib/pgsql/10/data. All of this data has been migrated to Postgres 15. Backup data and archives are not affected.

   sudo /var/lib/pgsql/delete_old_cluster.sh

For Ubuntu, OVA, and AMI

1. Remove the Postgres packages from the host:

   sudo dpkg -r --force-depends postgresql-10 postgresql-client-10

2. Remove the old Postgres data directory:

   This step only removes the data directory of the old Postgres version /var/lib/postgresql/10/main. All of this data has been migrated to Postgres 15. Backup data and archives are not affected.

   sudo /var/lib/postgresql/delete_old_cluster.sh

Review the upgrade script output

If the upgrade failed, review the output from the upgrade script. Splunk UBA Web does not load if the upgrade is unsuccessful.

1. Review the output from the upgrade script in /var/log/caspida/upgrade.out.
2. If needed, work with Splunk Support to resolve upgrade errors.

After resolving errors with the upgrade, run the upgrade script again. The upgrade script skips successful steps and only runs failed steps again.

Review the Health Monitor dashboard

Verify that all Splunk UBA services are running on the Health Monitor dashboard to confirm a successful upgrade.

1. Select System > Health Monitor to review the Health Monitor dashboard.

See Monitor the health of your Splunk UBA deployment in the Administer Splunk User Behavior Analytics manual.