Splunk Search

Is it possible to parse daily log file to report the time between OffHook and OnHook event

evilrsa
New Member

Did a little bit of searching, but didn't really find what I needed, but I also don't know if I'm even searching the best way/terms/ keywords.

I'm hoping Splunk can parse daily log file (.log) and look for the following lines:

05:49:15.416 ( 7528:11056) U-PE: 20000018 Hook:  1 (OffHook)
00:26:41.618 ( 7528: 7820) U-PE: 2000017A State: 12 (Established)
01:22:02.283 ( 7528:11056) U-PE: 20000156 Hook:  0 (OnHook)

The first part is just standard time in the %T.%f style formating.
The second part is always 5 numbers or 4 with a leading space a colon and 5 more numbers or 4 with a leading space.
The U-PE: is the event and the 8 alphanumeric ID that comes after that is uniquely bound to a user.

What I hope Splunk can do, is find every time there is a U-PE: OffHook event that does NOT have an Established U-PE: before the U-PE OnHook event, and report the time between the OffHook and OnHook event.

As for the 8 character User ID, there are about two or three hundred, but they are all unique.

0 Karma

jimodonald
Contributor

Yes, this is possible. I copy/pasted your small snippet of log and set up an ingestion into Splunk and extracted the fields you had identified (the field extraction might need some tweaking depending on your usage).

Props.conf is as follows:

[phonelog]
DATETIME_CONFIG = 
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Custom
pulldown_type = true
EXTRACT-transaction_id,user_id,state = ^[^\(\n]*\((?P<transaction_id>[^\)]+)[^:\n]*:\s+(?P<user_id>\w+)[^\(\n]*\((?P<state>\w+)

One you have the data extraction you should be able to find the duration of calls with the transaction command. It will look something like:

your_search | transaction state startswith="OffHook" endswith="OnHook"

Hope that helps!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...