Knowledge Management

What do the summary index fields stand for?

chiangs
Explorer

Summary indexing produces a lot of psrsvd_* fields. What do they stand for? I presume they're acronyms or abbreviations. Here are some examples when averaging the number of bytes returned per client IP, as logged by apache (ie 'sistats avg(bytes) by clientip'):

  • psrsvd_ct_bytes
  • psrsvd_gc
  • psrsvd_nc_bytes
  • psrsvd_sm_bytes
  • psrsvd_ss_bytes
  • psrsvd_v
  • psrsvd_vt_bytes

Here are some more for a count (in my case not literally, but basically 'sichart count by clientip')

  • psrsvd_gc
  • psrsvd_v
Tags (1)
1 Solution

ryhluc01
Communicator

You should accept your own answer. So that this question displays as solved. This information was very helpful.

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...