topic Re: Can I add UBA servers as deployment server clients? in Deployment Architecture

Can I add UBA servers as deployment server clients?

ilhwan — Wed, 25 Oct 2023 13:41:05 GMT

Splunk PS installed UBA a while back, and I just noticed that we are not getting OS logs from those servers into Splunk Enterprise. Since we have a 10 node cluster, I was trying to find a quicker way to manage them. Is there a reason I shouldn't connect the Splunk Enterprise running on all of those nodes to the deployment server?

Re: Can I add UBA servers as deployment server clients?

_JP — Wed, 25 Oct 2023 22:35:56 GMT

UBA isn't a Splunk Enterprise instance, but it does include a Splunk Universal Forwarder (UF) as part of its install (see Directories created or modified on the disk section of docs).

So, you should have a UF living at /opt/splunk for your UBA instance, and that's what you'll want to make sure is hooked up to the rest of your Splunk deployment. Also note the Splunk platform port requirements section on that page for more info about that UF instance running alongside the UBA install.

Re: Can I add UBA servers as deployment server clients?

ilhwan — Wed, 25 Oct 2023 22:57:56 GMT

I see. I was thinking it wasn't UF because every other instance of UF I've seen used /opt/splunkforwarder.

Re: Can I add UBA servers as deployment server clients?

cmeisch — Mon, 19 May 2025 20:02:09 GMT

Bringing this back to life (maybe).

Splunk UBA comes with an instance of Splunk. We install UF on all our nix machines to monitor them (performance and security). Well this install conflict with what UBA installs when setting up UBA (8089).

SO how do we overcome this OR how do we use the UBA Installed Splunk instance to connect to the deployment server and have the configuration we push to all the other servers go on this as well?