topic Splunk UBA deployment Requirement in Installation

Splunk UBA deployment Requirement

AtherAD — Tue, 07 May 2024 11:32:01 GMT

Hi Team,

I am trying to deploy the Splunk UBA node, but I get a bit confused because, in the Splunk UBA operating system requirements, I didn't find whether Red Hat 8.10 or 9.2 was supported or not. I only found the below information. How can I determine if Red Hat 8.10 or 9.2 are supported or not?

Operating System: Red Hat Enterprise Linux (RHEL) 8.8
Kernel-Version Tested: 4.18.0-477.10.1.el8_8.x86_64,
4.18.0-372.9.1.el8.x86_64

Re: Splunk UBA deployment Requirement

gcusello — Tue, 07 May 2024 12:18:07 GMT

Hi @AtherAD ,

We're deploying UBA and we had an instalation with Red Hat 8.8, with some packets in 8.9 and doesn't run!

Splunk Support confirmed that you must ne use that (with the present UBA release) all the packets will be the ones in the certified release, e.g. RedHat 8.8 without any update to greater releases.

And you must block all the updates, otherwise the installation will stop to run.

Ciao.

Giuseppe

Re: Splunk UBA deployment Requirement

YoungN — Tue, 14 May 2024 16:16:47 GMT

Red Hat 8.10 or 9.2 are not support as of yet, however you can try an install based on the older kernel version "4.18.0-477.27.1.el8_8.x86_64" that is supported. I have had some luck before by using the older kernel with an updated system but know that its not supported.

**There may be some bugs that haven't been tested yet by doing this but it will allow you to install.