Read Asterisk CDRs

[haonanzhang98]

I have Ubuntu 10.10 running Asterisk 1.6.

I want to use Splunk to index the Asterisk CDRs. It's one of the automatically supported filetypes. The CDR is located at /var/log/asterisk/cdr-csv/Master.csv.

I added it to the list of directories to monitor. It shows up as a source, but it doesn't index any events. It just says events indexed 1.

From the CLI, I have to use sudo cat /var/log/asterisk/cdr-csv/Master.csv to view it. Could permissions have something to do with it? Although I did start splunk with sudo...

[mloven_splunk]

If you run a search for:

index=* source="*Master.csv"

Do you get any results back? I suspect that since you're seeing one event, Splunk indexed the file, but it probably saw it as one huge log entry.

Also, how did you set up the input? Through the GUI? Did you specify a sourcetype?