Splunk Enterprise

Splunk Offline

garymilam72
New Member

I have 15 offline system I run weekly audits on. Is Splunk the way to go to analyze these audits? I will need to run Splunk on an offline system.

Labels (2)
Tags (1)
0 Karma

DavidHourani
Super Champion

Hi @garymilam72,

To answer your question, yes you can use Splunk to analyse the logs, that's exactly what it's made for logs and machine data ^^

If you're using an external hard drive then you can setup a Splunk monitor on the mount point, that way as soon as it's mounted data will go into Splunk. Since your system is offline it's probably the fastest way to get that data off your external hard disks.

Cheers,
David

0 Karma

garymilam72
New Member

So here is my process. I save all audit logs to an external hard drive. As of right now I have to manually go through all 15 systems logs to review looking for abnormalities. I want to bring those audits over to one system and analyze at once.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help to know more about your use case, but you should be able to do it. Carry your audit files to the Splunk system and use the oneshot command to ingest them. Then your off-line Splunk should be able to analyze the audits.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!