https://community.splunk.com/t5/Getting-Data-In/Using-Asterisk-s-CDR-stats-from-a-CSV-file-how-can-I-create-a/m-p/264012#M50659 <PRE><CODE>sourcetype = "cdr" | stats sum(duration) by src </CODE></PRE> <P>Doesn't give you what you need? When you say the entries in src are not unique, what other field makes a unique extension? Or is it a combination of fields?</P> Wed, 03 Feb 2016 01:47:36 GMT Jeremiah 2016-02-03T01:47:36Z https://community.splunk.com/t5/Getting-Data-In/Using-Asterisk-s-CDR-stats-from-a-CSV-file-how-can-I-create-a/m-p/264011#M50658 <P>Hi all.</P> <P>I am working with asterisk's cdr stats from a CSV file. </P> <P>Sample content of CSV:</P> <PRE><CODE> accountcode, src, dst, dcontext, clid, channel, dstchannel, lastapp, lastdata, start, answer, end, duration, billsec, disposition, amaflags, uniqueid, userfield "","2013","1245876543","from-internal","""Mobile"" &lt;2013&gt;","SIP/2013-00001127","SIP/Goip-chan14-020112b","Dial","SIP/Goip-chan1/43174242618,300,","2016-02-02 22:14:15",,"2016-02-02 22:14:49",34,0,"ANSWERED","DOCUMENTATION","1454451255.4391","" "","2013","12376530","from-internal","""Mobile"" &lt;2013&gt;","SIP/2013-00001121","SIP/Goip-chan12-00001123","Dial","SIP/Goip-chan12/23174849618,300,","2016-02-02 22:13:39",,"2016-02-02 22:14:11",32,0,"ANSWERED","DOCUMENTATION","1454451219.4385","" </CODE></PRE> <P>I want to show in a report the total "on-air" time by source extension, meaning a sum of the <CODE>duration</CODE> value per extension. I tried:</P> <PRE><CODE>sourcetype = "cdr" | table src, duration | addcolstats duration </CODE></PRE> <P>But doesn't work because the entries in src are not unique. Also, I tried using stats and top, but I can't show a unique list of extensions and the total duration time per day.</P> <P>Any suggestions?</P> <P>Thanks!</P> Tue, 02 Feb 2016 22:27:33 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Asterisk-s-CDR-stats-from-a-CSV-file-how-can-I-create-a/m-p/264011#M50658 changux 2016-02-02T22:27:33Z https://community.splunk.com/t5/Getting-Data-In/Using-Asterisk-s-CDR-stats-from-a-CSV-file-how-can-I-create-a/m-p/264012#M50659 <PRE><CODE>sourcetype = "cdr" | stats sum(duration) by src </CODE></PRE> <P>Doesn't give you what you need? When you say the entries in src are not unique, what other field makes a unique extension? Or is it a combination of fields?</P> Wed, 03 Feb 2016 01:47:36 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Asterisk-s-CDR-stats-from-a-CSV-file-how-can-I-create-a/m-p/264012#M50659 Jeremiah 2016-02-03T01:47:36Z https://community.splunk.com/t5/Getting-Data-In/Using-Asterisk-s-CDR-stats-from-a-CSV-file-how-can-I-create-a/m-p/264013#M50660 <P>Thanks. Very useful.</P> Wed, 10 Feb 2016 18:03:10 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Asterisk-s-CDR-stats-from-a-CSV-file-how-can-I-create-a/m-p/264013#M50660 changux 2016-02-10T18:03:10Z