About sherwin_r

sherwin_r · ‎08-13-2024

Thanks @gcusello @gjanders @isoutamo for your inputs. I will have to decide which solution I am going for. I will update if either worked as expected (however I expect it to take a couple of days). Regards, Sherwin

sherwin_r · ‎08-12-2024

Hi Ismo, This solution seems to be amazing. However, I will have to try to solve this as far as possible without installing an extra app. Best regards, Sherwin

sherwin_r · ‎08-12-2024

Hi @gcusello , Thanks for the quick response. I want to do this because my Splunk installation does not have access to the internet and Secure Gateway therefore logs a lot of errors. Regards, Sherwin

sherwin_r · ‎08-12-2024

I am trying to disable the Splunk Secure Gateway app in a clustered environment. However I dont see an option to disable the app in Apps -> Manage Apps. It only displays the current status of the app, which is "Active". I also tried the same in a single node installation, where there is an option to disable the app just next to its current status in the same menu, i.e. Apps -> Manage Apps. So, how can I disable the Splunk Secure Gateway in the clustered environment ?

sherwin_r · ‎11-08-2023

The data is complete in my case, because they are evaluated fields. One thing to note is that The column age is in a float format and expectedAge is in int format (Atleast looks like that).

sherwin_r · ‎11-08-2023

I am having trouble comparing the columns age and expectedAge, where the column expectedAge is a result of a lookup table. I tried the comparison with "where" as well as "search" clauses. Neither of them worked. I just simply want to select the rows where age > expectedAge. Expected behaviour : Return rows where the above mentioned condition is met. Actual behaviour : Returns nothing. | eval age=bla..bla..bla | lookup "expected_age_lookup" dummy_s as s OUTPUT expected_age | fillnull value=777 expected_age | rename expected_age as expectedAge | search age > expectedAge | convert ctime(dummy_Time) | table age,s,dummy_Time,expectedAge If I remove the lines following (and including) the where/search clause, I see the results of the lookup. How can I achieve this correctly ?

Posts	6
Solutions	0
Karma Given	5
Karma Received	0
Member Since	‎11-08-2023

Online Status	Offline
Date Last Visited	‎08-13-2024 07:15 AM

Disabling Splunk Secure Gateway in a Cluster Deplo...

Where/Search clause does not work with lookup.

Re: Disabling Splunk Secure Gateway in a Cluster D...

Re: Disabling Splunk Secure Gateway in a Cluster D...

Re: Disabling Splunk Secure Gateway in a Cluster D...

Disabling Splunk Secure Gateway in a Cluster Deplo...

Re: Where/Search clause does not work with lookup.

Where/Search clause does not work with lookup.