topic Re: Splunk Offline in Splunk Enterprise

Splunk Offline

garymilam72 — Wed, 10 Jun 2020 17:03:01 GMT

I have 15 offline system I run weekly audits on. Is Splunk the way to go to analyze these audits? I will need to run Splunk on an offline system.

Re: Splunk Offline

richgalloway — Fri, 24 May 2019 17:26:08 GMT

It would help to know more about your use case, but you should be able to do it. Carry your audit files to the Splunk system and use the oneshot command to ingest them. Then your off-line Splunk should be able to analyze the audits.

Re: Splunk Offline

garymilam72 — Fri, 24 May 2019 22:05:17 GMT

So here is my process. I save all audit logs to an external hard drive. As of right now I have to manually go through all 15 systems logs to review looking for abnormalities. I want to bring those audits over to one system and analyze at once.

Re: Splunk Offline

DavidHourani — Sat, 25 May 2019 07:41:57 GMT

Hi @garymilam72,

To answer your question, yes you can use Splunk to analyse the logs, that's exactly what it's made for logs and machine data ^^

If you're using an external hard drive then you can setup a Splunk monitor on the mount point, that way as soon as it's mounted data will go into Splunk. Since your system is offline it's probably the fastest way to get that data off your external hard disks.

Cheers,
David