Getting Data In

Using Asterisk's CDR stats from a CSV file, how can I create a report showing the sum of duration values per extension?

changux
Builder

Hi all.

I am working with asterisk's cdr stats from a CSV file.

Sample content of CSV:

 accountcode, src, dst, dcontext, clid, channel, dstchannel, lastapp, lastdata, start, answer, end, duration, billsec, disposition, amaflags, uniqueid, userfield 

 "","2013","1245876543","from-internal","""Mobile"" <2013>","SIP/2013-00001127","SIP/Goip-chan14-020112b","Dial","SIP/Goip-chan1/43174242618,300,","2016-02-02 22:14:15",,"2016-02-02 22:14:49",34,0,"ANSWERED","DOCUMENTATION","1454451255.4391","" 

  "","2013","12376530","from-internal","""Mobile"" <2013>","SIP/2013-00001121","SIP/Goip-chan12-00001123","Dial","SIP/Goip-chan12/23174849618,300,","2016-02-02 22:13:39",,"2016-02-02 22:14:11",32,0,"ANSWERED","DOCUMENTATION","1454451219.4385",""

I want to show in a report the total "on-air" time by source extension, meaning a sum of the duration value per extension. I tried:

sourcetype = "cdr" | table src, duration | addcolstats duration

But doesn't work because the entries in src are not unique. Also, I tried using stats and top, but I can't show a unique list of extensions and the total duration time per day.

Any suggestions?

Thanks!

0 Karma

Jeremiah
Motivator
sourcetype = "cdr" | stats sum(duration) by src 

Doesn't give you what you need? When you say the entries in src are not unique, what other field makes a unique extension? Or is it a combination of fields?

changux
Builder

Thanks. Very useful.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...