What do the fields psrsvd_gc=x and psrsvd_v=x mean?

[dmarasco]

What do the fields psrsvd_gc=x and psrsvd_v=x mean? Where do these fields come from and how are they used in the logs?

[David]

Those look like the output of the summary indexing si* commands. To use the si commands, you need to mirror the before and after commands exactly. For example, if your summary index is generated with

YourSearch | sistats count by host

Your search off of that index needs to be:

index=yoursummaryindex | stats count by host

(Here's an alternative way to do summary indexing)