Splunk Search

Find count of repeat phone calls

richnavis
Contributor

I'm would like to construct a search of our phone logs that provides a report indicating when a person calls someone back shortly after a call ends.  

Time_Start, Time_End, Source_Number, Dest_Number

10:10, 10:20, 555-1212,555-1313

10:22, 10:30, 555-1212,555-1313

In the example data above, I'd like to increment a field called "callbacks" for the source field.  The criteria for incrementing the callbacks field would be if the source number calls the destination number within 2 minutes of the call ending.   If the source number calls a different number, that shouldn't be added to callbacks.  I've written a lot of splunk searches, but this is beyond me..   Any guidance would be appreciated.  

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@richnavis 

Can you please try this?

YOUR_SEARCH
| autoregress Time_End as Time_End_pre p=1 
| autoregress Source_Number as Source_Number_pre p=1
| autoregress Dest_Number as Dest_Number_pre p=1
| eval duration_Time_End_pre=strptime(Time_End_pre,"%H:%M"),duration_Time_Start=strptime(Time_Start,"%H:%M")
| eval duration = round(duration_Time_Start-duration_Time_End_pre)
| eval callbacks = if(Source_Number=Source_Number_pre AND Dest_Number=Dest_Number_pre AND duration<=120,"True","False")
| table Time_Start, Time_End, Source_Number, Dest_Number duration callbacks

 

My Sample Search :

| makeresults | eval _raw="Time_Start, Time_End, Source_Number, Dest_Number
10:10, 10:20, 555-1212,555-1313
10:22, 10:30, 555-1212,555-1313" | multikv forceheader=1
| autoregress Time_End as Time_End_pre p=1 
| autoregress Source_Number as Source_Number_pre p=1
| autoregress Dest_Number as Dest_Number_pre p=1
| eval duration_Time_End_pre=strptime(Time_End_pre,"%H:%M"),duration_Time_Start=strptime(Time_Start,"%H:%M")
| eval duration = round(duration_Time_Start-duration_Time_End_pre)
| eval callbacks = if(Source_Number=Source_Number_pre AND Dest_Number=Dest_Number_pre AND duration<=120,"True","False")
| table Time_Start, Time_End, Source_Number, Dest_Number duration callbacks

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...