Splunk UBA deployment Requirement

[AtherAD]

Hi Team,

I am trying to deploy the Splunk UBA node, but I get a bit confused because, in the Splunk UBA operating system requirements, I didn't find whether Red Hat 8.10 or 9.2 was supported or not.  I only found the below information. How can I determine if Red Hat 8.10 or 9.2 are supported or not?

Operating System: Red Hat Enterprise Linux (RHEL) 8.8
Kernel-Version Tested: 4.18.0-477.10.1.el8_8.x86_64,
4.18.0-372.9.1.el8.x86_64

[YoungN]

Red Hat 8.10 or 9.2 are not support as of yet, however you can try an install based on the older kernel version "4.18.0-477.27.1.el8_8.x86_64" that is supported. I have had some luck before by using the older kernel with an updated system but know that its not supported. 

**There may be some bugs that haven't been tested yet by doing this but it will allow you to install.

[gcusello]

Hi @AtherAD ,

We're deploying UBA and we had an instalation with Red Hat 8.8, with some packets in 8.9 and doesn't run!

Splunk Support confirmed that you must ne use that (with the present UBA release) all the packets will be the ones in the certified release, e.g. RedHat 8.8 without any update to greater releases.

And you must block all the updates, otherwise the installation will stop to run.

Ciao.

Giuseppe