topic Re: EventHasNoEntities in Splunk User Behavior Analytics

EventHasNoEntities

ehsanafter — Sat, 25 Jan 2025 15:36:00 GMT

Hey guys
im trying to ingest haproxy logs in splunk uba.
now my issue is that im getting eventHasNoEntities for all events even tho they are parsed.
what does this error mean exactly?
does it mean it has no device or user associated with it?
or its missing some fields.
my main event key includes the whole haproxy logs

Re: EventHasNoEntities

jessieb_83 — Mon, 30 Jun 2025 19:55:02 GMT

Any luck with this?

I'm hitting the same. Far as I can tell it's a generic way to say that UBA is missing some key point of data, but I can't tell which thing it's looking for.

Re: EventHasNoEntities

PrewinThomas — Tue, 01 Jul 2025 04:35:54 GMT

@jessieb_83

Before adding event data to your UBA, make sure you have already integrated your HR, Asset, and Identity data. The error eventHasNoEntities occurs when your data lacks entity-related CIM-compliant fields or values. Ensure that,

Your UBA contains Asset and Identity data before importing any event data.

Your event data is CIM-compliant and includes the necessary entity data fields.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: EventHasNoEntities

jessieb_83 — Tue, 01 Jul 2025 14:46:16 GMT

Thanks for the input! I have Assets/Identities populated, I suspect my issue is CIM.

Only issue is I'm not clear exactly what field is missing.

Re: EventHasNoEntities

PrewinThomas — Wed, 02 Jul 2025 04:32:03 GMT

@jessieb_83

Do your proxy log events include fields that identify a user or a device (such as src, dest, src_ip, dest_ip, host ...)?
Typically, proxy logs should be mapped to the Web data model. Check that your logs contain the necessary fields for proper mapping.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!