Splunk Search

Read Asterisk CDRs

haonanzhang98
New Member

I have Ubuntu 10.10 running Asterisk 1.6.

I want to use Splunk to index the Asterisk CDRs. It's one of the automatically supported filetypes. The CDR is located at /var/log/asterisk/cdr-csv/Master.csv.

I added it to the list of directories to monitor. It shows up as a source, but it doesn't index any events. It just says events indexed 1.

From the CLI, I have to use sudo cat /var/log/asterisk/cdr-csv/Master.csv to view it. Could permissions have something to do with it? Although I did start splunk with sudo...

Tags (1)
0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

If you run a search for:

index=* source="*Master.csv"

Do you get any results back? I suspect that since you're seeing one event, Splunk indexed the file, but it probably saw it as one huge log entry.

Also, how did you set up the input? Through the GUI? Did you specify a sourcetype?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...