How to search call data records to find parallel concurrent calls from the same originating telephone number?

[garryclarke]

I have an index of telephony call data records where each record has an event_start_timestamp, mapped to the event time of each record in SPLUNK.

Each record represents a single call and also contains a duration field and originating and destination number values.

event_start_timestamp,originating_number, destination_number, duration_secs
00:00:10,0123456789,0987654321,45
00:00:09,0123456789,0987654321,12

What I am trying to create is, out of those originating numbers making parallel calls, a report of the originating_numbers making the highest number of concurrent calls.
In the above example the number 0123456789 is making parallel/concurrent calls.

I have tried looking at the concurrency command, however, I’m not totally clear on what it is outputting and also find it difficult to break down a concurrency number per originating number.

Any ideas or pointers on how I might do this would be greatly appreciated.

[woodcock]

I cannot think of any other way to do this so here goes. This method works but STINKS because it runs a new/separate search for each number:

| dedup originating_number | map search="search originating_number=$originating_number$ | concurrency duration=duration_secs" | stats max(concurrency) AS concurrency by originating_number | sort 0 - concurrency