topic Re: Why is UBA data stopping send data in Getting Data In

Why is UBA data stopping send data

zksvc — Tue, 14 Oct 2025 10:45:15 GMT

Hi everyone,

I’m investigating an issue where UBA (User Behavior Analytics) data in Splunk appears to have stopped ingesting or processing after October 11, 2025, even though today is October 14, 2025.

As shown in the screenshot, I ran this search:

index=ueba earliest=-7d | stats count by _time | sort - _time

The results show the latest _time entries are from 2025-10-11, with no events recorded on the 12th, 13th, or 14th. The time range of the search correctly spans from Oct 7 to Oct 14, so it’s not a time filter issue.

I’ve verified that:

Other indexes are receiving data normally.
The UBA app is enabled and licensed.
No recent configuration changes were made to UBA or its inputs.

Has anyone experienced this before? Could this be related to:

A known UBA ingestion delay or bug?
Timezone misconfiguration?
Data pipeline failure (e.g., forwarder, indexer, or UBA collector)?
Scheduled maintenance or throttling?

Any guidance or troubleshooting steps would be greatly appreciated!

Thanks in advance!

Re: Why is UBA data stopping send data

ITWhisperer — Tue, 14 Oct 2025 11:10:37 GMT

The sort command has a default limit. Try this instead

| sort 0 - _time

Re: Why is UBA data stopping send data

zksvc — Tue, 14 Oct 2025 11:27:37 GMT

Thanks for your reply, but it not work

Re: Why is UBA data stopping send data

ITWhisperer — Tue, 14 Oct 2025 12:06:20 GMT

Your screenshot shows a green dot by the job dropdown. What message do you get when you click this?

Re: Why is UBA data stopping send data

zksvc — Thu, 16 Oct 2025 08:28:21 GMT

Hey sorry for late reply, all is good since i do stop-all and start-all

i don't really know the issue is