I have a client that has Splunk deployed on their business network, and they would like to ingest data from an isolated network. The isolated network can send data outbound, but not receive inbound connections/communications. My recommendation was to collect the data on the isolated network and push it out to Splunk via one way file transfer. Then have Splunk monitor the file(s).  Has anyone else run into this scenario? If so, how did you architect a solution and was it successful? My assumption is that Universal Forwarders will not work in this situation because they require two way communication via TCP. Thank you ... View more

I've seen lots of script examples, but not an actual step by step process for using SCCM to install Universal Forwarders on Windows systems. I'm a beginner on splunk and SCCM. Looking to see if anything like that exists before I reinvent the wheel. Thanks ... View more