Splunk User Behavior Analytics

How to observe EPS for particular datasource from a Splunk UBA CLI?

vr2312
Builder

As the title suggests, i am trying to onboard multiple data sources in Splunk UBA. I would like to see if there is a way i can see from the CLI on the EPS per each data source ingested.

The EPS  fluctuates when we run data sources to ingest data from Specific time window even if the data exists within Splunk Enterprise as compared to AllTime. 

Labels (1)
0 Karma
1 Solution

vr2312
Builder

So after much thought and deliberation, this is how you can see the real-time EPS and the trends around it on UBA.

1. You would need to add the parameter ?system in the url right before the # values.

2. Once done, proceed to Manage -> Data Sources -> Select Data Source to reveal the real-time EPS and trends associated with it.

View solution in original post

Tags (5)
0 Karma

vr2312
Builder

So after much thought and deliberation, this is how you can see the real-time EPS and the trends around it on UBA.

1. You would need to add the parameter ?system in the url right before the # values.

2. Once done, proceed to Manage -> Data Sources -> Select Data Source to reveal the real-time EPS and trends associated with it.

Tags (5)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...