psloss and pdloss not showing up in results
Craig Merchant
cmerchant at responsys.com
Fri Feb 22 20:34:03 EST 2013
Carter,
I have the following search:
/usr/local/bin/racluster -S 10.10.10.10:561 -T 300 -p 3 -u -Z b -w - | /usr/local/bin/ralabel -r - -f /usr/local/argus/ralabel.conf -c "," -M dsrs=+metric,+agr,+psize,+cocode -n -p 3 -u -s "+0ltime,+1stime,+trans,+dur,+runtime,+mean,+stddev,+sum,+sco,+dco,+pkts,+spkts,+dpkts,+bytes,+sbytes,+dbytes,+load,+sload,+dload,+loss,+sloss,+dloss,+ploss,+psloss,+pdloss,+rate,+srate,+drate,+appbytes,+sappbytes,+dappbytes,+label:200" > /ssd/argus/splunk/racluster.csv
When I look at the racluster.csv file, the pLoss field is there, but I don't see any for psloss and pdloss. I see the following fields:
Argus Field
DAppBytes
Dir
Dport
DstAddr
DstBytes
DstLoad
DstLoss
DstPkts
DstRate
Dur
Flgs
Label
LastTime
Load
Loss
Mean
Proto
Rate
RunTime
SAppBytes
Sport
SrcAddr
SrcBytes
SrcLoad
SrcLoss
SrcPkts
SrcRate
StartTime
State
StdDev
Sum
TotAppByte
TotBytes
TotPkts
Trans
dCo
pLoss
sCo
Thx.
Craig
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130223/9707b971/attachment.html>
More information about the argus
mailing list