Best way to move windows logs via portable media from stand alone systems

[swagner1965]

Hi,

We use a few stand alone systems for scanning media and other tasks in our group. We are required to retrieve and archive these logs and since we use Splunk to do just that for everything else we want to work out a way to do the same with these systems. They are never plugged into the network and all movement of data in and out of these machines is via portable media.

What is the best way to do this? I want the data to end up indexed the same way that online systems are. Is there a way to use a fowarder on the stand alone system to write to a file that is easily consumed by Splunk or should I just massage the exported csv files from the Windows logs?

Cheers!

[swagner1965]

Answering this myself.

We are under RMF Controls which state that stand alone systems (sas) must have their logs pulled once a week. The sas is configured to retain its logs for a year. The requirement that logs be stored off system is met by placing a forwarder on the sas with the outputs.conf pointing to a local folder on the sas. That local folder is copied over to portable media which is then scanned prior to the files being moved into Splunk indexes on the enterprise network.

Since we are already doing virus definition updates weekly which involves portable media we have integrated the Splunk process into that.

[joshuaah]

Swagner,

I need to do the same things as you, in regards to pointing outputs.conf to local directory in an SAS. Do you have an example of the outputs.conf? how do you write the file to have all your data put in a local folder? Any help is much appreciated!

Thank you!

Josh

[swagner1965]

I am looking at putting a Forwarder on the stand alone systems but I need to figure out how to tell it to write the collected data to a file that can then be dropped in a network share and indexed from there. I am assuming I need to edit the outputs.conf in order to achieve this.