Archive

What do the fields psrsvd_gc=x and psrsvd_v=x mean?

New Member

What do the fields psrsvdgc=x and psrsvdv=x mean? Where do these fields come from and how are they used in the logs?

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Those look like the output of the summary indexing si* commands. To use the si commands, you need to mirror the before and after commands exactly. For example, if your summary index is generated with

YourSearch | sistats count by host

Your search off of that index needs to be:

index=yoursummaryindex | stats count by host

(Here's an alternative way to do summary indexing)