https://community.splunk.com/t5/Splunk-User-Behavior-Analytics/Assistance-Needed-Pulling-Data-from-Splunk-Enterprise-to-Splunk/m-p/752211#M82 <P>Hello Splunk Community,</P><P>I am a new Splunk UBA user and I am currently trying to pull data from Splunk Enterprise into Splunk UBA using <STRONG>time-based searches</STRONG>. I have followed the official UBA documentation and configuration guides, but I am still struggling to fully understand the process due to my limited experience with UBA.</P><P>Specifically, I am trying to:</P><UL><LI><P>Configure UBA to pull notable events and risk events from Splunk Enterprise Security.</P></LI><LI><P>Use time-based searches to collect data efficiently without missing events.</P></LI><LI><P>Understand how SPL queries and External Alarm categories work in this integration.</P></LI></UL><P>I would greatly appreciate any guidance, examples, or best practices you can share to help me successfully implement this integration.</P><P>Additionally, if you could suggest <STRONG>external resources, tutorials, or blogs</STRONG> that explain the process in a beginner-friendly way, that would be extremely helpful.</P><P>Thank you in advance for your support</P> Tue, 26 Aug 2025 06:51:52 GMT kn450 2025-08-26T06:51:52Z https://community.splunk.com/t5/Splunk-User-Behavior-Analytics/Assistance-Needed-Pulling-Data-from-Splunk-Enterprise-to-Splunk/m-p/752211#M82 <P>Hello Splunk Community,</P><P>I am a new Splunk UBA user and I am currently trying to pull data from Splunk Enterprise into Splunk UBA using <STRONG>time-based searches</STRONG>. I have followed the official UBA documentation and configuration guides, but I am still struggling to fully understand the process due to my limited experience with UBA.</P><P>Specifically, I am trying to:</P><UL><LI><P>Configure UBA to pull notable events and risk events from Splunk Enterprise Security.</P></LI><LI><P>Use time-based searches to collect data efficiently without missing events.</P></LI><LI><P>Understand how SPL queries and External Alarm categories work in this integration.</P></LI></UL><P>I would greatly appreciate any guidance, examples, or best practices you can share to help me successfully implement this integration.</P><P>Additionally, if you could suggest <STRONG>external resources, tutorials, or blogs</STRONG> that explain the process in a beginner-friendly way, that would be extremely helpful.</P><P>Thank you in advance for your support</P> Tue, 26 Aug 2025 06:51:52 GMT https://community.splunk.com/t5/Splunk-User-Behavior-Analytics/Assistance-Needed-Pulling-Data-from-Splunk-Enterprise-to-Splunk/m-p/752211#M82 kn450 2025-08-26T06:51:52Z