topic Re: Add-on for Cisco Webex video conference in Getting Data In

Add-on for Cisco Webex video conference

Lwoods — Thu, 20 Jul 2023 17:30:10 GMT

Hello,

I would like to find an add-on for my webex devices. I know there's the Cisco WebEx Meetings Add-on for Splunk, but wanted to see what every one else is using.

The Cisco WebEx Meetings Add-on inputs.conf is

[general_service]
start_by_shell = false
python.version = python3
sourcetype = cisco:webex:meetings:general:summarysession
interval = 60
live = True
disabled = 0

[history_service]
start_by_shell = false
python.version = python3
sourcetype = cisco:webex:meetings:history:meetingusagehistory
interval = 86400
endpoints = []
disabled = 0

What does this configuration capture?

Thanks

Re: Add-on for Cisco Webex video conference

meetmshah — Thu, 20 Jul 2023 18:10:17 GMT

Hello @Lwoods, Yes you can use that TA. Here's the documentation that will help you - https://github.com/splunk/ta-cisco-webex-meetings-add-on-for-splunk/blob/master/README.md

One input is to get the general services and the other for Historical events (Interval should be 86400 / 24 hours or more for historical data)

Re: Add-on for Cisco Webex video conference

Lwoods — Thu, 20 Jul 2023 18:15:24 GMT

That's where I got the input stanza info, but wasn't for sure if that would work. Do I have to create separate input stanza for all these sourcetypes?

Re: Add-on for Cisco Webex video conference

Lwoods — Thu, 20 Jul 2023 18:41:45 GMT

@meetmshah

Re: Add-on for Cisco Webex video conference

meetmshah — Thu, 20 Jul 2023 19:00:42 GMT

It's been a while I used that TA, however, I just had a test input created and below is the stanza that got generated -

[history_service://Hello] endpoints = LstmeetingusageHistory~LstmeetingattendeeHistory~LsttrainingsessionHistory~LsteventsessionHistory index = main interval = 86400 paging_interval = 1 paging_interval_unit = Day start_time_start = 07/17/2023 23:59:59

So, I believe that based on the XML API inputs you select from inputs (there is an option to select what level of granular fields you want), sourcetype would be assigned.

Please hit Karma, if this helps!