Getting Data In

Using Asterisk's CDR stats from a CSV file, how can I create a report showing the sum of duration values per extension?

changux
Builder

Hi all.

I am working with asterisk's cdr stats from a CSV file.

Sample content of CSV:

 accountcode, src, dst, dcontext, clid, channel, dstchannel, lastapp, lastdata, start, answer, end, duration, billsec, disposition, amaflags, uniqueid, userfield 

 "","2013","1245876543","from-internal","""Mobile"" <2013>","SIP/2013-00001127","SIP/Goip-chan14-020112b","Dial","SIP/Goip-chan1/43174242618,300,","2016-02-02 22:14:15",,"2016-02-02 22:14:49",34,0,"ANSWERED","DOCUMENTATION","1454451255.4391","" 

  "","2013","12376530","from-internal","""Mobile"" <2013>","SIP/2013-00001121","SIP/Goip-chan12-00001123","Dial","SIP/Goip-chan12/23174849618,300,","2016-02-02 22:13:39",,"2016-02-02 22:14:11",32,0,"ANSWERED","DOCUMENTATION","1454451219.4385",""

I want to show in a report the total "on-air" time by source extension, meaning a sum of the duration value per extension. I tried:

sourcetype = "cdr" | table src, duration | addcolstats duration

But doesn't work because the entries in src are not unique. Also, I tried using stats and top, but I can't show a unique list of extensions and the total duration time per day.

Any suggestions?

Thanks!

0 Karma

Jeremiah
Motivator
sourcetype = "cdr" | stats sum(duration) by src 

Doesn't give you what you need? When you say the entries in src are not unique, what other field makes a unique extension? Or is it a combination of fields?

changux
Builder

Thanks. Very useful.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...