I have an index of telephony call data records where each record has an event_start_timestamp
, mapped to the event time of each record in SPLUNK.
Each record represents a single call and also contains a duration field and originating and destination number values.
event_start_timestamp,originating_number, destination_number, duration_secs
00:00:10,0123456789,0987654321,45
00:00:09,0123456789,0987654321,12
What I am trying to create is, out of those originating numbers making parallel calls, a report of the originating_number
s making the highest number of concurrent calls.
In the above example the number 0123456789 is making parallel/concurrent calls.
I have tried looking at the concurrency command, however, I’m not totally clear on what it is outputting and also find it difficult to break down a concurrency number per originating number.
Any ideas or pointers on how I might do this would be greatly appreciated.
I cannot think of any other way to do this so here goes. This method works but STINKS because it runs a new/separate search for each number:
| dedup originating_number | map search="search originating_number=$originating_number$ | concurrency duration=duration_secs" | stats max(concurrency) AS concurrency by originating_number | sort 0 - concurrency