psloss and pdloss not showing up in results

[Carter Bullard]

The percent loss fields are " sploss " and " dploss ".
Carter

On Feb 22, 2013, at 8:34 PM, Craig Merchant <cmerchant at responsys.com> wrote:

> Carter,
>  
> I have the following search:
>  
> /usr/local/bin/racluster -S 10.10.10.10:561 -T 300 -p 3 -u -Z b -w - | /usr/local/bin/ralabel -r - -f /usr/local/argus/ralabel.conf -c "," -M dsrs=+metric,+agr,+psize,+cocode -n -p 3 -u -s "+0ltime,+1stime,+trans,+dur,+runtime,+mean,+stddev,+sum,+sco,+dco,+pkts,+spkts,+dpkts,+bytes,+sbytes,+dbytes,+load,+sload,+dload,+loss,+sloss,+dloss,+ploss,+psloss,+pdloss,+rate,+srate,+drate,+appbytes,+sappbytes,+dappbytes,+label:200" > /ssd/argus/splunk/racluster.csv
>  
> When I look at the racluster.csv file, the pLoss field is there, but I don’t see any for psloss and pdloss.  I see the following fields:
>  
> Argus Field
> DAppBytes
> Dir
> Dport
> DstAddr
> DstBytes
> DstLoad
> DstLoss
> DstPkts
> DstRate
> Dur
> Flgs
> Label
> LastTime
> Load
> Loss
> Mean
> Proto
> Rate
> RunTime
> SAppBytes
> Sport
> SrcAddr
> SrcBytes
> SrcLoad
> SrcLoss
> SrcPkts
> SrcRate
> StartTime
> State
> StdDev
> Sum
> TotAppByte
> TotBytes
> TotPkts
> Trans
> dCo
> pLoss
> sCo
>  
> Thx.
>  
> Craig

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130223/59a8fa42/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2589 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130223/59a8fa42/attachment.bin>