Hello,
it's works ! , need just modify some details 🙂
index="cucm_cdr" OR index="cucm_cmr" sourcetype=cucm_cdr OR sourcetype=cucm_cmr
NOT INTEGER NOT globalCallID_callId globalCallId_ClusterID=*(type="outgoing" OR type="incoming")
|eval userID=mvappend(finalCalledPartyUnicodeLoginUserID, callingPartyUnicodeLoginUserID )
| search amares OR sbordea OR cserban OR andran OR vladr
| top limit=20 day_of_week
i would like to keep it like that but split by Total userID calls by day with one colors for each user, instead of total calls by day
It's possible to keep the original order of day : monday , tue, web,thu,Fri ?
PS: In public we can show all possibilities of Splunks Cisco CDR's , amazing ! 🙂
thanks
Thomas
... View more