About Toups

Toups · ‎12-07-2010

The code: LINE_BREAKER=([\x00\r\n]+) Does not appear to be removing the "\x00\x00\x00" from the

Toups · ‎12-06-2010

Thank you, I think this is the information we were looking for. Your time and attention is greatly appreciated!

Toups · ‎12-06-2010

It sounds like index time extraction is best as many of the fields are adjancent. Why do you recommend against items such as time or dialed number in the extraction at index? The target application with be a Call Detail Record index, and a sub-component of an event correlation system.

Toups · ‎12-06-2010

I am working with the following input and wanted some advice on how/where to specify the field extractions: "\x00\x00\x00103700079 C9E840 13372786523 7137 210018 51730064 #850 1 000 " I have documentation from the vendor specifying value lengths and definitions and we can perform most field extractions via individial regex field extractions, but we wanted to know if there is a better or more effecient method recommended. For regerence, the field mapping table is listed below and have included samples for a couple of the current field extractions. 1-2 Time of day-hours 3-4 Time of day-minutes 5 Duration-hours 6-7 Duration-minutes 8 Duration-tenths of minutes 9 Condition code 10-13 Access code dialed 14-17 Access code used 18-32 Dialed number 33-42 Calling number 43-57 Account code 58-64 Authorization code 65-66 Space 67 FRL 68-70 Incoming circuit ID (hundreds, tens, units) 71-73 Outgoing circuit ID (hundreds, tens, units) 74 Feature flag 75-76 Attendant console 77-80 Incoming TAC 81-82 Node number 83-85 INS 86-88 IXC 89 BCC 90 MA-UUI 91 Resource flag 92-95 Packet count 96 TSC flag 97-100 Reserved 101 Carriage return (Not displayed) 102 Line feed (Not displayed) 103-105 Null (displayed as “\x00\x00\x00” at beginning of new line) For example, to extract the duration hours, minutes, tenths of minutes we use the following regex: "^.{16}(?<duration_hours>\d{1})" "^.{17}(?<duration_minutes>\d{2})" "^.{19}(?<duration_tenths_minutes>\d{1})"

Toups · ‎12-03-2010

Updated from version 4.1.5 to 4.1.6 and updated the local props.conf as follows, then restarted Splunk. [source::tcp:9001] TZ = America/Chicago CHECK_FOR_HEADER = False SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 16 TIME_PREFIX = ^.{12} TIME_FORMAT = %H %M The issue appears to be resolved in cursory testing, however I will edit/update accordingly after additional testing has been verified.

Toups · ‎12-03-2010

I have updated the original post with a sample of the source log information.

Toups · ‎12-03-2010

I have searched the documentation and have not yet found how to omit or delete specific fields from an input. The input in question is a ASCII string and we would like to remove the "irellivant" data prior to indexing and segmentation for a couple reasons. As always, thank you all in advance for your assistance. Few feilds indexing = optimized indexing and searching Minimize the volume of data (where practical) to maximize the storage capabilities. Below is a sample log entry actual telephone numbers are masked here for secuirty. An example of the information we would like to omit would be (\x00\x00\x00) which is a null value indicating the end of the previous line. "\x00\x00\x00160900429 C9E820 28155512127135552121 20080310 #850 1 010"

Toups · ‎12-03-2010

Splunk does not require a specific port, rather it is leveraging existing protocols and their designations. This will be dependent upon many factors specific to each individual implementation. Below are a few examples: HTTP HTTPS: Syslog SNMP WMI ..... Addition details about each protocol and associate port with descriptions are availble via Wikipedia

Toups · ‎12-03-2010

Within a windows environment, Splunk is installed with an administrator account and installs/modifies multiple services while running. May I recommend an alternative; change your security model within splunk to LLDP. Once completed, you can create and associate user groups based on permissions defined within the Splunk installation. Example: Within Splunk, select the "user" profile then you can selectively add/remove access within the installed Splunk applications. LDAP: Create a new group "splunk_user" This domain group can be very restricted, so long as they can logon, print, browse intranet/specific sites... Back to Splunk, where we add the association for the LDAP "splunk_user" to the Splunk "user" effectively isolating their access beyond basic services.

Toups · ‎12-02-2010

Any updates on these efforts? I am in process of building a CDR app for Avaya Communication Manager systems, and would be ideal to match the form and function of this with the Cisco CDR application you are working on. Goal: Similar interface (possibly universal), various backend inputs.

Toups · ‎12-02-2010

Preface: The timestamp is in HHMM format from the source, year/month/day information is not provided. The data is provided via a TCP string from a CDR log. I have the following input string: "\x00\x00\x00130000059 C9E840 1210....." I have added entries to the local props.com as follows: [source::tcp:9001] TZ = America/Chicago CHECK_FOR_HEADER = False SHOULD_LINEMERGE = False MAX_TIMESTAMP_LOOKAHEAD = 16 TIME_PREFIX = ^.{12} TIME_FORMAT = %H %M The issue: timestamps appear to work fine EXCEPT for the first 5 minutes of each hour. In the example above the timestamp is 4 digits log starting after position 12 with a value of "1300" however splunk is decoding the timestamp as "1359" instead of "1300" as defined. Once time reaches 6 minutes past the hour, the timestamp works as expected producing a timestamp of "1306"; an example is: "\x00\x00\x00130600869 C9E820 713....." Any assistance is greatly appreciated.

Toups · ‎11-04-2010

Thank you, I have found the same documentation (most links/programs are invalid) and understand this will need a RTCP listener. I am surprised however by the lack of interest from the "voice" admins of the world in what they can do with Splunk.

Toups · ‎11-04-2010

I have seen a couple of apps/blogs/questions regarding integrating voice performance metrics, however it appears (from what I have found) this is a field with limited Splunking to date. I have some basic criteria and short and long term project goals, however I am curious if anyone else has already started an effort in this direction. I am investigating options for receiving and indexing RTCP reports generated by IP endpoints such as Avaya and Cisco. The UDP stream is directed at the server port of 5005 however Splunk only reports received data as a single "^" or similar symbol. Wireshark shows more detailed information but again once it hits Splunk, all bets are off. Below are some of the data sources of interest for cross referancing and advanced troubleshooting and data analysis: CDR data (simple text string, not an issue) RTP/RTCP reported metrics (no so simple, see above) Periodic user list for cross reference by name/local (long, but again simple text) Dynamic system configurations (exported periodically and processed) and the list goes on..... Any assistance in getting pointed in the right direction would be greatly appreciated, and I can provide copious amounts of detail and log data to anyone interested.

Posts	13
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎11-04-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

Field extraction at index, or use transforms?

Delete/Ignore specified value -updated-

Extract timestamp without date?

VoIP reporting via RTCP?

Re: Field extraction at index, or use transforms?

Re: Field extraction at index, or use transforms?

Re: Field extraction at index, or use transforms?

Field extraction at index, or use transforms?

Re: Extract timestamp without date?

Re: Delete/Ignore specified value -updated-

Delete/Ignore specified value -updated-

Re: Official Port for Splunk from IETF

Re: More specific requirements for permissions on ...

Re: Cisco CDR Plug-In

Extract timestamp without date?

Re: VoIP reporting via RTCP?

VoIP reporting via RTCP?