Splunk Search

Need to correlate two different data sources

msarro
Builder

Alright, so I am trying to correlate a call data record (essentially the billing part of a telephone call) with a media description of the call. I need to end up with a table of the following values:

  • Called_Number (source 1)
  • Calling_Number (source 1)
  • Start_Time (source 1)
  • Release_Time (source 1)
  • Answer_Time (source 1)
  • Call_Duration (calculated Release_Time-Start_Time)
  • Time_To_Answer (calculated Answer_Time-Start_Time)
  • Termination_Cause (source 1)
  • Redirecting_Reason (source 1)
  • Delay (source 2)
  • Lost_Packets (source 2)
  • Jitter (source 2)
  • Out_Of_Order_Packets (source 2)
  • MOSLQ (source 2)
  • Codec (source 2)

The only field that overlaps in the two record types are the calling and called numbers. The timestamp is unreliable since the second source lacks any kind of precision (limited to 1m).

When I try to use transaction none of the eval statements work, and half of my fields end up missing. I think this is because there are multiple calls in that 1m span of time (its a test server where numerous calls occur rapidly).

I've looked around and people mention using stats to solve things like this, but I am having trouble finding out more information. Any advice would be appreciated.

Here is a sample from source 1:

0000027234843c69c420110324001353.9890+000000,wdv-trunking,Normal,+15555555501,+15555550037,Originating,+15555555501,Public,15555552354,20110324001353.989,0+000000,Yes,20110324001357.546,20110324001405.770,016,VoIP,,15555552354,national,tf,5555552354,,local,1.2.3.4:5060,[email protected],PCMU/8000/1,1.2.3.4,958a3d58-afe8410-13c4-50029-2e0209-adada88-2e0209,,,,auto_508_1,,,,,,,,,,y,public,,1647234:0,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,[email protected],,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8.555,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,Network,,,,,,,,,,,,,,,,,,,,

Here is a sample from source 2:

"Date","Interface","Source Extension","Dest. Extension","Delay","Lost","Jitter","Out-of-Order","MOS LQ","Codec"
"03/23/11 at 8:13 PM","eth 0/1","5555555501","5555558737","72 ms","0","1 ms","0","4.200","G711U"

I've sanitized the raw data... the third field in each is the calling number. As you can see the original has an e164 format number (+1) whereas the one in the second source does not.

Any help would be greatly appreciated.

Tags (1)
0 Karma

adrianathome
Communicator

Look into doing a join. Something like search1 |join commonfield [search2] | table fields,that,you,want

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – August 2026

MichelleCorpora_1-1788182384472.png Welcome to the August 2026 edition of Data Management Digest! August was a ...

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...