Getting Data In

Using Asterisk's CDR stats from a CSV file, how can I create a report showing the sum of duration values per extension?

changux
Builder

Hi all.

I am working with asterisk's cdr stats from a CSV file.

Sample content of CSV:

 accountcode, src, dst, dcontext, clid, channel, dstchannel, lastapp, lastdata, start, answer, end, duration, billsec, disposition, amaflags, uniqueid, userfield 

 "","2013","1245876543","from-internal","""Mobile"" <2013>","SIP/2013-00001127","SIP/Goip-chan14-020112b","Dial","SIP/Goip-chan1/43174242618,300,","2016-02-02 22:14:15",,"2016-02-02 22:14:49",34,0,"ANSWERED","DOCUMENTATION","1454451255.4391","" 

  "","2013","12376530","from-internal","""Mobile"" <2013>","SIP/2013-00001121","SIP/Goip-chan12-00001123","Dial","SIP/Goip-chan12/23174849618,300,","2016-02-02 22:13:39",,"2016-02-02 22:14:11",32,0,"ANSWERED","DOCUMENTATION","1454451219.4385",""

I want to show in a report the total "on-air" time by source extension, meaning a sum of the duration value per extension. I tried:

sourcetype = "cdr" | table src, duration | addcolstats duration

But doesn't work because the entries in src are not unique. Also, I tried using stats and top, but I can't show a unique list of extensions and the total duration time per day.

Any suggestions?

Thanks!

0 Karma

Jeremiah
Motivator
sourcetype = "cdr" | stats sum(duration) by src 

Doesn't give you what you need? When you say the entries in src are not unique, what other field makes a unique extension? Or is it a combination of fields?

changux
Builder

Thanks. Very useful.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...