Requirements for Kafka data ingestion

Verify the requirements and compatible software versions for using Kafka data ingestion.

Requirements for using the Splunk UBA Kafka Ingestion App

Before you can send data from Splunk Enterprise directly to Kafka, verify the following:

• The account being used to install the Splunk UBA Kafka Ingestion App must have admin privileges on Splunk Enterprise.
• Edit the /etc/hosts file in your Splunk Enterprise environment so that all indexers and search heads are able to resolve the host names of the Splunk UBA nodes.
• All indexers and search heads must not be on the same subnet that Splunk UBA uses for its containers. By default, Docker containers in Splunk UBA use IP addresses in the 172.x.x.x range. See Change the IP address of your Docker containers in Administer Splunk User Behavior Analytics if you need to modify this IP range.
• Configure NTP in the Splunk Enterprise environment so that the time on Splunk Enterprise is the same as the time in Splunk UBA.
• Make sure port 9093 is open on all nodes where the Kafka broker is running so the indexers on Splunk Enterprise can send data to Kafka in Splunk UBA. View the /opt/caspida/conf/deployment/caspida-deployment.conf file to see where services are running in your Splunk UBA deployment.

Compatible Splunk platform and Splunk UBA versions

Verify the compatibility requirements for the Splunk platform, Splunk UBA, and the Splunk UBA Kafka Ingestion App. See the Splunk UBA product compatibility matrix in the Plan and Scale your Splunk UBA Deployment manual.

Splunk Enterprise must be installed on a supported Linux operating system.

If you are using an incompatible version of the Splunk UBA Kafka Ingestion App, you will see error messages beginning with the following text in the Splunk Data Source Search Status Check:

HTTP 400 - Error in 'sendtoubakafka' command: (ValueError)