Splunk® User Behavior Analytics Monitoring App

Splunk UBA Monitoring App

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Splunk UBA Monitoring App requirements

The Splunk UBA Monitoring App requires the following combination of Splunk UBA with Splunk Enterprise or Splunk Cloud Platform:

Splunk UBA Monitoring App version Splunk UBA version Splunk Enterprise version
Splunk UBA Monitoring App 1.1.2 Splunk UBA 5.0.3 or higher Splunk Enterprise versions 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.2.0
Splunk Cloud Platform
Splunk UBA Monitoring App 1.1.1 Splunk UBA 5.0.3 or higher Splunk Enterprise versions 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.2.0
Splunk Cloud Platform
Splunk UBA Monitoring App 1.1 Splunk UBA 5.0.3 Splunk Enterprise versions 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.2.0
Splunk UBA Monitoring App 1.0.0 Splunk UBA 5.0.0 Splunk Enterprise versions 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.2.0

Additional requirements for the Splunk UBA Monitoring App

  • The Splunk UBA Monitoring App forwards data to the _internal index on the Splunk platform. Users of the Splunk UBA Monitoring App must have read access to the _internal index in order to see any data when using the app. Users with the admin role in Splunk Enterprise or sc_admin role in Splunk Cloud Platform have this permission by default. Non-admin users can be granted this access by qualified admin or sc_admin users.
  • The forwarder on Splunk UBA connects to the Splunk platform receiver on port 9997 by default. The receiver on Splunk Enterprise must be enabled to receive data from the forwarder on Splunk UBA. See Enable a receiver in the Splunk Enterprise Forwarding Data manual.
Last modified on 27 April, 2022
PREVIOUS
About the Splunk UBA Monitoring App
  NEXT
Install the Splunk UBA Monitoring App

This documentation applies to the following versions of Splunk® User Behavior Analytics Monitoring App: 1.1.2


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters