|-a suffix length|
|default is 2 characters.|
|-d||Toggle running as a deamon.|
Supported spliting modes are:
count <num> size <size> time <period> flow "filter-expression"
Rasplit supports an extended -w option that allows for
output record contents to be inserted into the output filename.
Specified using $ (dollar) notation, any printable field can be used.
Care should be taken to honor any shell escape requirements when
specifying on the command line. See ra(1) for the list of
Another extended feature, when using time mode, rasplit will process the supplied filename using strftime(3), so that time fields can be inserted into the resulting output filename.
This invocation reads argus(8) data from inputfile and splits the argus(8) data stream based on output file size of no greater than 1 Megabyte. The resulting output files have a prefix of argus. and suffix that starts with aa. The single trailing . is significant.
rasplit -r inputfile -M size 1m -w argus.
This invocation splits inputfile based on hard 10 minute time boundaries. The resulting output files are created with a prefix of /archive/%Y/%m/%d/argus. and the suffix is %H.%M.%S. The values will be supplied based on the time in the record being written out.rasplit -r * -M time 10m -w "/archive/%Y/%m/%d/argus.%H.%M.%S"
This invocation splits inputfile based on the argus source identifier. The resulting output files are created with a prefix of /archive/Source Identifier/argus. and the default suffix starting with "aa". The source identifier will be supplied based on the contents of the record being exported.rasplit -r * -M time 10m -w "/archive/$srcid/argus."This invocation splits inputfile based on a flow event marker. The resulting output files are created with a prefix of outfile. and the default suffix starting with "aa". Whenever a ping to a specific host is seen in the stream, a new output file is generated.
rasplit -r * -M flow "echo and host 18.104.22.168" -w outfile.
Copyright (c) 2000-2014 QoSient. All rights reserved.
Carter Bullard (email@example.com).
|rasplit 3.0.8||RASPLIT (1)||12 August 2003|