A few unrelated questions...

[Carter Bullard]

Hey Craig,
That file is in every client distribution, so I would have to say that, yes, rarc.print.all.conf
has many of the options.  There is also a rarc.csv file in ./support/Config, so I suggest
that you look around at the support we provide.  Many answers are there.

If you go through the rarc file, you'll see a pretty detailed description of most of the options.

Precision is controlled in the rarc file, as well as the " -p x" option.  You want -p 0.

even simple tools can reveal the answer to many of your questions:

MeinTing:~ carter$ man ra | fgrep precision

           Use the -p <num> option to specify the precision right of the deci-
           Print <digits> number of units of precision for floating point val-
           tion times, with precision  to  the  microsecond.  However,  ra  by

There is a huge discussion of keystrokes in the sample rarc file, ./support/Config/rarc,
and all the variables are there.  There is a published paper on the algorithm, and its
available on the argus web site, under Publications.

Not sure how I can support Splunk, if Splunk can't read a database table.
Carter

On Jan 17, 2013, at 9:40 PM, Craig Merchant <cmerchant at responsys.com> wrote:

> Carter,
>  
> Is there a master list of all of the field options for –s?  You mentioned the snstroke and dnstroke in the post about SSH keystrokes, but I don’t see them in the documentation for ra online.  I found this thru google which seems to list all of the field options, though some of them are still kind of cryptic:
>  
> http://fossies.org/unix/misc/argus-clients-3.0.7.4.tar.gz:a/argus-clients-3.0.7.4/support/Config/rarc.print.all.conf
>  
> Is there any way to control the decimal precision of numeric fields?  It would be particularly nice if I could choose to use “0” instead of “0.000000”.
>  
> What do the values for snstroke and dnstroke represent?   I’ve turned it on with the defaults and if I type away at a moderate pace (like 30-50 wpm), it might give a value of 9-15.  If I type quickly (80+ wpm), it seems to intermittently give me very high or very low values.  Are there any best practices for tuning the keystroke recognition settings?
>  
> This might be more of a feature request…  It would be great if the sql commands used for creating time indexes for files could be written to a text file instead of a database.  That way I could index it in Splunk rather than have to deal with the complexity of managing (yet another) database…
>  
> Thanks for all your help!
>  
> Craig
>  

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130118/37f8b8fd/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2589 bytes
Desc: not available
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20130118/37f8b8fd/attachment.bin>