Splunk Search

Find count of repeat phone calls

richnavis
Contributor

I'm would like to construct a search of our phone logs that provides a report indicating when a person calls someone back shortly after a call ends.  

Time_Start, Time_End, Source_Number, Dest_Number

10:10, 10:20, 555-1212,555-1313

10:22, 10:30, 555-1212,555-1313

In the example data above, I'd like to increment a field called "callbacks" for the source field.  The criteria for incrementing the callbacks field would be if the source number calls the destination number within 2 minutes of the call ending.   If the source number calls a different number, that shouldn't be added to callbacks.  I've written a lot of splunk searches, but this is beyond me..   Any guidance would be appreciated.  

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@richnavis 

Can you please try this?

YOUR_SEARCH
| autoregress Time_End as Time_End_pre p=1 
| autoregress Source_Number as Source_Number_pre p=1
| autoregress Dest_Number as Dest_Number_pre p=1
| eval duration_Time_End_pre=strptime(Time_End_pre,"%H:%M"),duration_Time_Start=strptime(Time_Start,"%H:%M")
| eval duration = round(duration_Time_Start-duration_Time_End_pre)
| eval callbacks = if(Source_Number=Source_Number_pre AND Dest_Number=Dest_Number_pre AND duration<=120,"True","False")
| table Time_Start, Time_End, Source_Number, Dest_Number duration callbacks

 

My Sample Search :

| makeresults | eval _raw="Time_Start, Time_End, Source_Number, Dest_Number
10:10, 10:20, 555-1212,555-1313
10:22, 10:30, 555-1212,555-1313" | multikv forceheader=1
| autoregress Time_End as Time_End_pre p=1 
| autoregress Source_Number as Source_Number_pre p=1
| autoregress Dest_Number as Dest_Number_pre p=1
| eval duration_Time_End_pre=strptime(Time_End_pre,"%H:%M"),duration_Time_Start=strptime(Time_Start,"%H:%M")
| eval duration = round(duration_Time_Start-duration_Time_End_pre)
| eval callbacks = if(Source_Number=Source_Number_pre AND Dest_Number=Dest_Number_pre AND duration<=120,"True","False")
| table Time_Start, Time_End, Source_Number, Dest_Number duration callbacks

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...