Why is UBA data stopping send data

[zksvc]

Hi everyone,

I’m investigating an issue where UBA (User Behavior Analytics) data in Splunk appears to have stopped ingesting or processing after October 11, 2025, even though today is October 14, 2025.

As shown in the screenshot, I ran this search:

index=ueba earliest=-7d | stats count by _time | sort - _time

The results show the latest _time entries are from 2025-10-11, with no events recorded on the 12th, 13th, or 14th. The time range of the search correctly spans from Oct 7 to Oct 14, so it’s not a time filter issue.

I’ve verified that:

• Other indexes are receiving data normally.
• The UBA app is enabled and licensed.
• No recent configuration changes were made to UBA or its inputs.

Has anyone experienced this before? Could this be related to:

• A known UBA ingestion delay or bug?
• Timezone misconfiguration?
• Data pipeline failure (e.g., forwarder, indexer, or UBA collector)?
• Scheduled maintenance or throttling?

Any guidance or troubleshooting steps would be greatly appreciated!

Thanks in advance!

last-log-11-oct.png

[ITWhisperer]

The sort command has a default limit. Try this instead

| sort 0 - _time

[zksvc]

Thanks for your reply, but it not work 

[ITWhisperer]

Your screenshot shows a green dot by the job dropdown. What message do you get when you click this?

[zksvc]

Hey sorry for late reply, all is good since i do stop-all and start-all 

i don't really know the issue is