EventHasNoEntities

[ehsanafter]

Hey guys
im trying to ingest haproxy logs in splunk uba.
now my issue is that im getting eventHasNoEntities for all events even tho they are parsed.
what does this error mean exactly?
does it mean it has no device or user associated with it?
or its missing some fields.
my main event key includes the whole haproxy logs

[jessieb_83]

Any luck with this? 

I'm hitting the same.  Far as I can tell it's a generic way to say that UBA is missing some key point of data, but I can't tell which thing it's looking for. 

[PrewinThomas]

@jessieb_83 

Before adding event data to your UBA, make sure you have already integrated your HR, Asset, and Identity data. The error eventHasNoEntities occurs when your data lacks entity-related CIM-compliant fields or values. Ensure that,

Your UBA contains Asset and Identity data before importing any event data.

Your event data is CIM-compliant and includes the necessary entity data fields.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[jessieb_83]

Thanks for the input! I have Assets/Identities populated, I suspect my issue is CIM. 

Only issue is I'm not clear exactly what field is missing. 

[PrewinThomas]

@jessieb_83 

Do your proxy log events include fields that identify a user or a device (such as src, dest, src_ip, dest_ip, host ...)?
Typically, proxy logs should be mapped to the Web data model. Check that your logs contain the necessary fields for proper mapping.

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!