topic Transaction command with multiple fields in Splunk Search

Transaction command with multiple fields

bcarnot — Tue, 21 Nov 2017 18:10:30 GMT

I have this start event. I am using the "Phonecall" as the key in the transaction.
1. InteractionEvent on Phonecall-1244025-01a102b0xxxxxxxx, Dn: 1244025@8800, Status: Ringing, StatusChanged: true, Reason: Ringing,
2. Constructing inbound telephony interaction , cli = 1655491xxxx, dnis = 1290xxx, entereddigits = ...

I want to include the inbound caller's phone number (cli) in the table to show duration of call.
The "Phonecall" key is not included in the line of logs where the "cli" is identified.

| transaction Phonecall startswith="Status: Ringing"
endswith="Reason: Done" | table cli Phonecall reason status reason duration eventcount

Re: Transaction command with multiple fields

somesoni2 — Tue, 21 Nov 2017 18:35:43 GMT

If there is no matching field (Phonecall is not available in logs with cli field) how can it identify to which Phonecall event it belongs to? There can be multiple Phone calls in the logs and there may be overlap in the events.

Re: Transaction command with multiple fields

micahkemp — Tue, 21 Nov 2017 18:45:51 GMT

Do you know that the line with Phonecall defined always immediately precedes the line with cli? If so you may be able to use:

| streamstats window=2 current=t last(cli) AS lastcli
| transaction lastcli startswith="Status: Ringing" endswith="Reason: Done"

Re: Transaction command with multiple fields

bcarnot — Tue, 21 Nov 2017 21:26:30 GMT

Thank you for your response.
This is the layout of the log every time
Phonecall -xxx Reason: Ringing
cli= caller

The cli will always come after the ringing event.
Thank you for your time, it is really appreciated.

2017-11-21 08:08:44,254 DEBUG InteractionEvent on Phonecall-1244025-01a102b009cxxxxx, Dn: 1244xxx@RB8800, Status: Ringing, StatusChanged: true, Reason: Ringing, Extensions: {Attached Data Changed=}, TEventExtensions: , TEventReasons: null CallId: 1594
2017-11-21 08:08:44,254 DEBUG ***
2017-11-21 08:08:44,254 TRACE Constructing inbound telephony interaction , cli = 1555491xxxx, dnis = 129xxxx, entereddigits = ...
2017-11-21 08:08:44,254 TRACE Setting Telephony System Call ID to null for interaction
2017-11-21 08:08:44,254 TRACE Setting CLI to 1555491xxxx
2017-11-21 08:08:44,254 TRACE Setting DNIS to 129xxxx
2017-11-21 08:08:44,254 TRACE Setting UCID to 15xx
2017-11-21 08:08:44,254 TRACE Setting Telephony System Call ID to Phonecall-1244025-01a102b009cxxxxx

Re: Transaction command with multiple fields

bcarnot — Tue, 21 Nov 2017 21:58:43 GMT

the cli event happens 1st then a Phonecall ID is assigned.

2017-11-21 08:08:44,254 TRACE Constructing inbound telephony interaction , cli = 15554910544, dnis = 1290008, entereddigits = ...
2017-11-21 08:08:44,254 TRACE Setting Telephony System Call ID to null for interaction
2017-11-21 08:08:44,254 TRACE Setting CLI to 15554910544
2017-11-21 08:08:44,254 TRACE Setting DNIS to 1290008
2017-11-21 08:08:44,254 TRACE Setting UCID to 1594
2017-11-21 08:08:44,254 TRACE Setting Telephony System Call ID to Phonecall-1244025-01a102b009cc3b53