Splunk Offline

[garymilam72]

I have 15 offline system I run weekly audits on. Is Splunk the way to go to analyze these audits? I will need to run Splunk on an offline system.

[DavidHourani]

Hi @garymilam72,

To answer your question, yes you can use Splunk to analyse the logs, that's exactly what it's made for logs and machine data ^^

If you're using an external hard drive then you can setup a Splunk monitor on the mount point, that way as soon as it's mounted data will go into Splunk. Since your system is offline it's probably the fastest way to get that data off your external hard disks.

Cheers,
David

[garymilam72]

So here is my process. I save all audit logs to an external hard drive. As of right now I have to manually go through all 15 systems logs to review looking for abnormalities. I want to bring those audits over to one system and analyze at once.

[richgalloway]

It would help to know more about your use case, but you should be able to do it. Carry your audit files to the Splunk system and use the oneshot command to ingest them. Then your off-line Splunk should be able to analyze the audits.