topic Re: How to observe EPS for particular datasource from a Splunk UBA CLI? in Splunk User Behavior Analytics

How to observe EPS for particular datasource from a Splunk UBA CLI?

vr2312 — Fri, 22 Sep 2023 18:22:22 GMT

As the title suggests, i am trying to onboard multiple data sources in Splunk UBA. I would like to see if there is a way i can see from the CLI on the EPS per each data source ingested.

The EPS fluctuates when we run data sources to ingest data from Specific time window even if the data exists within Splunk Enterprise as compared to AllTime.

Re: How to observe EPS for particular datasource from a Splunk UBA CLI?

vr2312 — Tue, 04 Jun 2024 04:25:41 GMT

So after much thought and deliberation, this is how you can see the real-time EPS and the trends around it on UBA.

1. You would need to add the parameter ?system in the url right before the # values.

2. Once done, proceed to Manage -> Data Sources -> Select Data Source to reveal the real-time EPS and trends associated with it.