All Apps and Add-ons

CDR file of huawei CSOFTX3000

ryainad
Explorer

I have CDR file of huawei CSOFTX3000, and sample with first 50 decoded CDRs.

What I need to do is to get all information from CDR files and save in database or even .txt files (doesn't matter where).

I found and want to use a tool in perl Splunk Huawei CSOFTX3000, but I don't know does it work with my file?

0 Karma
1 Solution

dmillis
Splunk Employee
Splunk Employee

There is a longer discussion of how this perl script works here: http://blogs.splunk.com/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles/

You can test the perl script with your logfile from the command line:
1) Change directory into $SPLUNK_HOME/etc/apps/Splunk_HuaweiCsoftX3000/bin
2) cat <your Huawei binary logfile name> | ./huawei2text.pl

You should see a lot of single-line records, something like this:
2010/12/04 00:07:38 Serial_Number="2147529748",Serial_Number_in_module="20980895",Module_Number="52",CDR_type="PDSN_BILL",Charge_start_time="2010/12/04 00:07:38",Caller_party_number= ...

The Serial_Number fields should be incrementing with each record.

If you do NOT see this, or the values look weird, or the Serial_Number values aren't successive, you may have Huawei logs which have a record length different than 350 bytes; this perl script is designed to work with a 350-byte record length.

View solution in original post

dmillis
Splunk Employee
Splunk Employee

There is a longer discussion of how this perl script works here: http://blogs.splunk.com/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles/

You can test the perl script with your logfile from the command line:
1) Change directory into $SPLUNK_HOME/etc/apps/Splunk_HuaweiCsoftX3000/bin
2) cat <your Huawei binary logfile name> | ./huawei2text.pl

You should see a lot of single-line records, something like this:
2010/12/04 00:07:38 Serial_Number="2147529748",Serial_Number_in_module="20980895",Module_Number="52",CDR_type="PDSN_BILL",Charge_start_time="2010/12/04 00:07:38",Caller_party_number= ...

The Serial_Number fields should be incrementing with each record.

If you do NOT see this, or the values look weird, or the Serial_Number values aren't successive, you may have Huawei logs which have a record length different than 350 bytes; this perl script is designed to work with a 350-byte record length.

ryainad
Explorer

I have tested with logfile, 1st record is decoded right, but others are wrong.
It seems I have a record length different than 350 bytes. How to know record length?
I have documentation, but there is description for all record length.

And How can I change this app to my decode my logfile?
Thank you in advance!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...