Splunk Uba Setup

Splunk UBA Setup

Prerequisites

Workflow Overview

┌───────────┐   ┌───────────────┐   ┌───────────────┐   ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘   └───────────────┘   └───────────────┘   └─────────────────┘

When to Activate

• Validating Splunk UBA / UEBA readiness, optional UBA Kafka ingestion app placement, and migration guidance to Splunk Enterprise Security Premier UEBA without installing standalone UBA servers.
• Preview and review the splunk uba setup workflow before any live apply phase.
• Diagnose failed prerequisites, generated assets, configuration, or validation evidence.

Scope

Follow the documented read-only or render-first path whenever it is available. This skill does not imply permission to mutate live systems. Require explicit apply flags, protected credentials, and operator review for state changes.

Examples

Inspect the supported setup modes before selecting one:

bash skills/splunk-uba-setup/scripts/setup.sh --help

Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.

Inspect validation modes before running completion checks:

bash skills/splunk-uba-setup/scripts/validate.sh --help

Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.

Troubleshooting

Shared add-on completion gate

Whenever this workflow installs, validates, or hands off a UBA support app or Kafka add-on, follow the shared completion gate. Package delivery alone is not success; validate applicable ingest and consuming views, or record explicit package evidence that no dashboards ship.

Use this skill when the user asks for Splunk User Behavior Analytics (UBA) or UEBA readiness. Standalone Splunk UBA is end-of-sale and this repo must not pretend to automate a supported UBA server installation. This skill provides:

• Existing UBA/UEBA support-app and index validation
• Optional Splunk UBA Kafka Ingestion App install (Splunk-UBA-SA-Kafka, Splunkbase 4147)
• Explicit end-of-sale/end-of-support reporting
• Migration guidance toward Splunk Enterprise Security Premier UEBA

Workflow

1. Read this file and reference.md.

2. Start with a dry run:

   bash skills/splunk-uba-setup/scripts/setup.sh --dry-run --json
   

3. Validate an existing UBA/UEBA integration:

   bash skills/splunk-uba-setup/scripts/validate.sh
   

4. Install the UBA Kafka ingestion app only when the deployment still requires it and the package is available:

   bash skills/splunk-uba-setup/scripts/setup.sh --install-kafka-app
   

5. Use local package install for restricted or pre-downloaded packages:

   bash skills/splunk-uba-setup/scripts/setup.sh \
     --install-kafka-app \
     --source local \
     --file /path/to/splunk-uba-kafka-ingestion-app.tgz
   

Guardrails

• Do not install standalone UBA servers from this skill.
• Do not claim that UBA is newly purchasable. Report the published standalone UBA end-of-sale and end-of-support dates.
• Prefer ES Premier UEBA migration guidance for new work.
• Treat Kafka app installation as optional and legacy/readiness-focused.
• Splunkbase app 4147 version 1.4.6 currently advertises 9.2 through 10.2 on selected release trains and does not advertise 10.5. For the repository's Splunk Cloud 10.5 target, the shared installer refuses the known-incompatible package before mutation. Only --accept-unsupported-platform, backed by documented vendor approval for this exact legacy package and stack, can override the refusal; the override is not compatibility certification.