Knowledge Management

What do the summary index fields stand for?

chiangs
Explorer

Summary indexing produces a lot of psrsvd_* fields. What do they stand for? I presume they're acronyms or abbreviations. Here are some examples when averaging the number of bytes returned per client IP, as logged by apache (ie 'sistats avg(bytes) by clientip'):

  • psrsvd_ct_bytes
  • psrsvd_gc
  • psrsvd_nc_bytes
  • psrsvd_sm_bytes
  • psrsvd_ss_bytes
  • psrsvd_v
  • psrsvd_vt_bytes

Here are some more for a count (in my case not literally, but basically 'sichart count by clientip')

  • psrsvd_gc
  • psrsvd_v
Tags (1)
1 Solution

ryhluc01
Communicator

You should accept your own answer. So that this question displays as solved. This information was very helpful.

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...