Knowledge Management

What do the summary index fields stand for?


Summary indexing produces a lot of psrsvd_* fields. What do they stand for? I presume they're acronyms or abbreviations. Here are some examples when averaging the number of bytes returned per client IP, as logged by apache (ie 'sistats avg(bytes) by clientip'):

  • psrsvd_ct_bytes
  • psrsvd_gc
  • psrsvd_nc_bytes
  • psrsvd_sm_bytes
  • psrsvd_ss_bytes
  • psrsvd_v
  • psrsvd_vt_bytes

Here are some more for a count (in my case not literally, but basically 'sichart count by clientip')

  • psrsvd_gc
  • psrsvd_v
Tags (1)
1 Solution


You should accept your own answer. So that this question displays as solved. This information was very helpful.

0 Karma

Revered Legend
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!