- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
chiangs
Explorer
11-29-2011
08:03 AM
Summary indexing produces a lot of psrsvd_* fields. What do they stand for? I presume they're acronyms or abbreviations. Here are some examples when averaging the number of bytes returned per client IP, as logged by apache (ie 'sistats avg(bytes) by clientip'):
- psrsvd_ct_bytes
- psrsvd_gc
- psrsvd_nc_bytes
- psrsvd_sm_bytes
- psrsvd_ss_bytes
- psrsvd_v
- psrsvd_vt_bytes
Here are some more for a count (in my case not literally, but basically 'sichart count by clientip')
- psrsvd_gc
- psrsvd_v
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
chiangs
Explorer
11-29-2011
01:48 PM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
chiangs
Explorer
11-29-2011
01:48 PM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ryhluc01
Communicator
02-05-2019
11:31 AM
You should accept your own answer. So that this question displays as solved. This information was very helpful.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
02-05-2019
01:34 PM
Now on Splunk Docs:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/Usesummaryindexing
