SPLUNK UBA End of Sale/End of Life
Frequently Asked Questions (FAQ)
What is happening to Splunk UBA?
Splunk User Behavior Analytics (UBA) will reach its End of Sale (EOS) on December 10, 2025. If your UBA license extends beyond this date, you may continue to use the product until your current license term ends; however, please note that support will no longer be available after December 2026.
Why are Splunk and Cisco making this change?
We are evolving our User and Entity Behavior Analytics (UEBA) capabilities by integrating them directly into Splunk Enterprise Security (ES) Editions. This strategic move allows us to deliver a more unified, efficient, and powerful security operations platform, providing faster outcomes and streamlined workflows within a single solution that includes SIEM, UEBA, SOAR, and AI.
What should I do if I currently use Splunk UBA?
We strongly recommend upgrading to a Splunk Enterprise Security Edition that best suits your SOC strategy. Our team is ready to help you understand how our ES editions meet your needs.
Are there differences between Splunk UBA and the new UEBA capability?
Yes, there are several differences between the two. UEBA is now natively embedded into Splunk ES, allowing your security team to detect, investigate and remediate insider and unknown threats without having to jump around different tools and solutions. Also, you can eliminate (or repurpose) the servers required by the standalone UBA, removing hardware maintenance overhead and providing superior scalability and agility. Your account team and our product management team can further discuss the details of differences between the solutions.
Will my existing UBA data or configurations migrate to ES Premier's UEBA?
No, there is no direct configuration or data migration path from standalone UBA to the new UEBA capability. The UEBA feature is implemented as a fresh, natively integrated capability designed for improved accuracy and faster time-to-value within the ES environment. Our team will provide guidance after reviewing your existing UBA use cases to translate how they can be addressed with our new UEBA capability.
What if my contract for Splunk UBA extends beyond December 2026?
We understand that you may have active contracts that extend past the End of Life date. Please reach out to your dedicated account team. We are committed to working with you to discuss your specific situation and explore the best path forward to ensure continuity and strategy of your security operations.
Can I just get the UEBA feature without purchasing an ES edition?
No, the enhanced UEBA capability is a core feature of Splunk ES Premier and is not available as a standalone product. ES Premier is designed as an integrated solution to provide comprehensive security benefits.
What if I have Splunk UBA with a Splunk ES Cloud stack?
The recommended path for you is to transition to ES Premier in the cloud. Our teams can work with you to discuss the timing, licensing, logistics, and options on the transition. By moving to ES Premier, your teams will be able to utilize the integrated UEBA capabilities and enjoy a fully unified, native cloud experience for your security operations. You will also no longer need to invest in maintenance costs associated with dedicated servers for UBA.
What if I currently use Splunk UBA but do not have Splunk ES?
Please connect with your account team for further guidance and on paths we can take to help meet the needs of your security program.
Where can I find more information about Splunk ES Editions and UEBA?
Your dedicated account team is your primary resource for detailed information, demonstrations, and discussions about Splunk ES. We encourage you to reach out to them to schedule a personalized session.