Splunk Search

How do I extract these fields from Avaya CDR logs that are currently missing from search results?

kgangulw
Engager

Hello,

We have avaya phones in our environment and logs are being populated to Splunk. We need to get some basic reports from the log data, but even after reading many online resources, I'm unable to work out what's needed to get this working.

Currently when I run a search below is the output. However, I need to make a visual representation based on certain fields which do not show up in the standard field list.

Could someone pls help out? I have made the fields of interest in Bold.

Dec 11 09:16:44 V7205-RSP-L2 stm[3912]: <503293> <INFO> <V7205-RSP-L2 100.220.100.4> |voice| VM: CDR generated for client IP:120.202.62.128 Name:1467 ALG:H323 Dir:IC Peer Party:- Status:SUCC Dur:17 Orig time:Dec 11 09:16:27 2015 R-value:93 Reason:Terminated Codec: Band:GREEN Setup Time:0 Re-Assoc:0 Initial-BSSID:00:00:00:00:00:00 Initial-ESSID: Initial-AP Name:

The fields highlighted in bold do not appear in the standard field list and I tried the field extraction method, but still couldn't get that to work either. thanks

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This rex command will extract the fields you specified. If you need other fields, it's fairly simple to add them to the regex.

... | rex "client IP:(?P<clientIP>[^ ]+).*Status:(?P<Status>\w+).*Reason:(?P<Reason>\w+).*Band:(?P<Band>\w+)" | ...

You can also put this regex string into the field extractor to have the fields extracted automatically.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This rex command will extract the fields you specified. If you need other fields, it's fairly simple to add them to the regex.

... | rex "client IP:(?P<clientIP>[^ ]+).*Status:(?P<Status>\w+).*Reason:(?P<Reason>\w+).*Band:(?P<Band>\w+)" | ...

You can also put this regex string into the field extractor to have the fields extracted automatically.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kgangulw
Engager

Thank you for the quick reply. much appreciated.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...