Getting Data In

Using Asterisk's CDR stats from a CSV file, how can I create a report showing the sum of duration values per extension?

changux
Builder

Hi all.

I am working with asterisk's cdr stats from a CSV file.

Sample content of CSV:

 accountcode, src, dst, dcontext, clid, channel, dstchannel, lastapp, lastdata, start, answer, end, duration, billsec, disposition, amaflags, uniqueid, userfield 

 "","2013","1245876543","from-internal","""Mobile"" <2013>","SIP/2013-00001127","SIP/Goip-chan14-020112b","Dial","SIP/Goip-chan1/43174242618,300,","2016-02-02 22:14:15",,"2016-02-02 22:14:49",34,0,"ANSWERED","DOCUMENTATION","1454451255.4391","" 

  "","2013","12376530","from-internal","""Mobile"" <2013>","SIP/2013-00001121","SIP/Goip-chan12-00001123","Dial","SIP/Goip-chan12/23174849618,300,","2016-02-02 22:13:39",,"2016-02-02 22:14:11",32,0,"ANSWERED","DOCUMENTATION","1454451219.4385",""

I want to show in a report the total "on-air" time by source extension, meaning a sum of the duration value per extension. I tried:

sourcetype = "cdr" | table src, duration | addcolstats duration

But doesn't work because the entries in src are not unique. Also, I tried using stats and top, but I can't show a unique list of extensions and the total duration time per day.

Any suggestions?

Thanks!

0 Karma

Jeremiah
Motivator
sourcetype = "cdr" | stats sum(duration) by src 

Doesn't give you what you need? When you say the entries in src are not unique, what other field makes a unique extension? Or is it a combination of fields?

changux
Builder

Thanks. Very useful.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...