Use of psrsvd fields in summary index

Is there any danger using psrsvd_vm_* type fields? Are they likely to change?

Use case:
I didn't need a count by siteid before, so I didn't include that in the sistats call that populates the summary. This reduced the number of entries in the summary index greatly. I did need dc(siteid), though, so the counts are actually there in the psrsvd_vm_siteid field. With a little juggling, I can rip those values back apart and use them like so.

... | eval _raw=psrsvd_vm_siteid | rex max_match=1000000 "(?<s>.*?;.*?);" | mvexpand s | eval _raw=s | fields -* -_* | rex "(?<siteid>.*?);(?<count>.*)" | stats count by siteid

Is there any danger in this?

asked 28 Sep '11, 10:52

vbumgarner
1.8k●2●10
accept rate: 23%

Be the first one to answer this question!

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

summary-index ×150
summary ×46

Asked: 28 Sep '11, 10:52

Seen: 422 times

Last updated: 28 Sep '11, 10:52

Use of psrsvd fields in summary index

Follow this question

Splunk Resources

Related questions