How do I extract these fields from Avaya CDR logs that are currently missing from search results?

[kgangulw]

Hello,

We have avaya phones in our environment and logs are being populated to Splunk. We need to get some basic reports from the log data, but even after reading many online resources, I'm unable to work out what's needed to get this working.

Currently when I run a search below is the output. However, I need to make a visual representation based on certain fields which do not show up in the standard field list.

Could someone pls help out? I have made the fields of interest in Bold.

Dec 11 09:16:44 V7205-RSP-L2 stm[3912]: <503293> <INFO> <V7205-RSP-L2 100.220.100.4> |voice| VM: CDR generated for client IP:120.202.62.128 Name:1467 ALG:H323 Dir:IC Peer Party:- Status:SUCC Dur:17 Orig time:Dec 11 09:16:27 2015 R-value:93 Reason:Terminated Codec: Band:GREEN Setup Time:0 Re-Assoc:0 Initial-BSSID:00:00:00:00:00:00 Initial-ESSID: Initial-AP Name:

The fields highlighted in bold do not appear in the standard field list and I tried the field extraction method, but still couldn't get that to work either. thanks

[richgalloway · Accepted solution]

This rex command will extract the fields you specified. If you need other fields, it's fairly simple to add them to the regex.

... | rex "client IP:(?P<clientIP>[^ ]+).*Status:(?P<Status>\w+).*Reason:(?P<Reason>\w+).*Band:(?P<Band>\w+)" | ...

You can also put this regex string into the field extractor to have the fields extracted automatically.

[kgangulw]

Thank you for the quick reply. much appreciated.