Enable Kafka data ingestion

Enable Kafka ingestion in Splunk UBA when adding a data source using the Splunk Direct or Splunk Raw Events connector. See Use connectors to add data from the Splunk platform to Splunk UBA for information about when to use the Splunk Direct connector and when to use the Splunk Raw Events connector.

Perform the following steps to enable Kafka data ingestion:

1. In Splunk UBA, select Manage > Data Source.
2. In the New Data Source window, select Splunk in the SIEM Connectors category and click Next.
3. Specify the connection details to Splunk Enterprise. In the Connector Type field, select either Splunk Direct or Splunk Raw Events.
4. Select the Kafka Ingestion checkbox.
   
5. Click Next.
6. Navigate through the remainder of the screens, and then click OK at the end to create the data source.

When configuring a custom Splunk data source for Kafka ingestion, make sure that the custom SPL used in the data source query only uses commands that can run on Splunk indexers. If a custom data source query includes a command that cannot be run on Splunk indexers, Kafka ingestion will not be properly distributed out and will only run on the search head. To learn which commands can run, see Processing attributes in the Search Manual.