Splunk User Behavior Analytics

How to change User Identification in Splunk UBA HR data

mld_msr
New Member
hello everyone
I ran into a problem with Splunk UBA that I need help with. Thank you for guiding me.
I have more than one domain in Splunk UBA and it mistakenly recognizes some users as the same user due to name similarity.
While these users are not the same person and only have name similarities in the login ids field.

How can I solve this problem and have users with the same login ids but not have false positive anomalies?

Thank you for your guidance.
Labels (1)
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...