Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ssingh313
ssingh313
Path Finder
Member since:
07-21-2016
06-05-2020
Community Statistics
| Posts | 28 |
| Solutions | 0 |
| Karma Given | 9 |
| Karma Received | 0 |
| Member Since | 07-21-2016 |
Activity Feed
- Karma Re: Text box search for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Displaying specific text from logs for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Displaying specific text from logs for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Creating a search table on dashboard for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Creating a search table on dashboard for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Data log on dashboard for sundareshr. 06-05-2020 12:48 AM
- Karma Re: Data log on dashboard for somesoni2. 06-05-2020 12:48 AM
- Karma Re: Is there a way to open data logs on the same dashboard from a table instead of redirecting to another page? for sundareshr. 06-05-2020 12:48 AM
- Karma Delete Splunk Account for hbottjer. 06-05-2020 12:46 AM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-08-2016 07:25 AM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-08-2016 07:07 AM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-05-2016 12:47 PM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-05-2016 12:25 PM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-05-2016 10:27 AM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-05-2016 10:25 AM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-04-2016 11:18 AM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-03-2016 06:40 PM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-03-2016 06:10 PM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-03-2016 04:58 PM
- Posted Re: Invalid value Drilldown error on Splunk Search. 08-03-2016 04:06 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
08-08-2016
07:25 AM
This is what the XML code looks like, it is currently displaying all the logs in the server when I click on a specific attribute instead of just that log is there a way to fix that.
<form>
<label>Genesys Search Test</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="tok_ID" searchWhenChanged="true">
<label>ConnID/CallUUID</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>Genesys Server</title>
<table>
<title>Avaya Tserver</title>
<search>
<query>index=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | rex"(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex"AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex"AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex"AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex"AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"|rex"AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"|rex"AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)"|table_time EventName AttributeConnID AttributeANI AttributeDNIS AttributeCallType AttributeCallUUID AttributeUserData| where isnotnull(AttributeANI)</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<drilldown>
<condition>
<set token="tok_ShowEvents">true</set>
<eval token="e">$click.value$-1</eval >
<eval token="l">$click.value$+1</eval >
<set token="AttributeConnID">$row.AttributeConnID$</set>
<set token="AttributeANI">$row.AttributeANI$</set>
<set token="AttributeCallType">$row.AttributeCallType$</set>
<set token="AttributeDNIS">$row.AttributeDNIS$</set>
<set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
</condition>
</drilldown>
<option name="wrap">undefined</option>
<option name="rowNumbers">undefined</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bubble</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">10</option>
</table>
</panel>
</row>
<row>
<panel depends="$tok_ShowEvents$">
<event>
<search>
<query>index=windowsapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex "AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex "AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"| rex "AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)"</query>
<earliest></earliest>
<latest></latest>
</search>
</event>
</panel>
</row>
</form>
... View more
08-08-2016
07:07 AM
Here is the XML code so far, right now it opens the data logs but it shows all the data logs when I click on a specific attribute instead of just that one. is there a way to fix that?
<form>
<label>Genesys Search Test</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="tok_ID" searchWhenChanged="true">
<label>ConnID/CallUUID</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>Genesys Server</title>
<table>
<title>Avaya Tserver</title>
<search>
<query>index=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | rex"(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex"AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex"AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex"AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex"AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"|rex"AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"|rex"AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)"|table_time EventName AttributeConnID AttributeANI AttributeDNIS AttributeCallType AttributeCallUUID AttributeUserData| where isnotnull(AttributeANI)</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<drilldown>
<condition>
<set token="tok_ShowEvents">true</set>
<eval token="e">$click.value$-1</eval >
<eval token="l">$click.value$+1</eval >
<set token="AttributeConnID">$row.AttributeConnID$</set>
<set token="AttributeANI">$row.AttributeANI$</set>
<set token="AttributeCallType">$row.AttributeCallType$</set>
<set token="AttributeDNIS">$row.AttributeDNIS$</set>
<set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
</condition>
</drilldown>
<option name="wrap">undefined</option>
<option name="rowNumbers">undefined</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bubble</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">10</option>
</table>
</panel>
</row>
<row>
<panel depends="$tok_ShowEvents$">
<event>
<search>
<query>index=windowsapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex "AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex "AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"| rex "AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)"</query>
<earliest></earliest>
<latest></latest>
</search>
</event>
</panel>
</row>
</form>
... View more
08-05-2016
12:25 PM
That textbox is used to search specific attributes in the table so there isn't a defaultt value for that. I want the logs to be able to be displayed once you click on that attribute regardless of there be something in the search box or not. is that possible?
... View more
08-05-2016
10:25 AM
my code looks like this but I still get a "Search is waiting for input... " error. Is there another method to test this?
... View more
08-04-2016
11:18 AM
so I try this query and get a Error in 'eval' command: The expression is malformed. Expected ).
<query>index=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | eval filter=if(_time<relative_time($e$, "-1s") OR _time>relative_time($e$,relative_time($e$, "+1s"), "No", "Yes") | where filter="Yes"</query>
... View more
08-03-2016
06:10 PM
do I add this to the code or change the drilldown code that I have?
... View more
08-03-2016
04:58 PM
This is what my entire code looks like right now. I tried removing the eval elements and it gives me a search is waiting for input error.
<form>
<label>Genesys Search Test</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="tok_ID" searchWhenChanged="true">
<label>ConnID/CallUUID</label>
<default></default>
</input>
</fieldset>
<row>
<panel>
<title>Genesys Server</title>
<table>
<title>Avaya Tserver</title>
<search>
<query>index=windowsapps sourcetype=Genesys_AvayaTserver "$tok_ID$" | rex"(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex"AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex"AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex"AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex"AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"|rex"AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"|rex"AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)"|table_time EventName AttributeConnID AttributeANI AttributeDNIS AttributeCallType AttributeCallUUID AttributeUserData| where isnotnull(AttributeANI)</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<drilldown>
<set token="tok_ShowEvents">true</set>
<set token="AttributeConnID">$row.AttributeConnID$</set>
<set token="AttributeANI">$row.AttributeANI$</set>
<set token="AttributeCallType">$row.AttributeCallType$</set>
<set token="AttributeDNIS">$row.AttributeDNIS$</set>
<set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
</drilldown>
<option name="wrap">undefined</option>
<option name="rowNumbers">undefined</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bubble</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">10</option>
</table>
</panel>
</row>
<row>
<panel depends="$tok_ShowEvents$">
<event>
<search>
<query>index=windowsapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex "AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex "AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"| rex "AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)"</query>
<earliest></earliest>
<latest></latest>
</search>
</event>
</panel>
</row>
</form>
... View more
08-03-2016
04:06 PM
I have earliest and latest as part of another query within the code.
... View more
08-03-2016
08:44 AM
this is still giving me the same error Invalid value "1468323531.847-1" for time term 'earliest'
... View more
08-03-2016
08:25 AM
I have a table on my dashboard which contains values that link to the actual data log on splunk. I am trying to open the data logs within the dashboard and I am using the drilldown code below but I keep on getting an "Invalid value "1468323531.846-1" for time term 'earliest' " error. Below is the code I'm using. Anyone know how I can fix this?
<drilldown>
<set token="tok_ShowEvents">true</set>
<set token="e">$click.value$-1</set>
<set token="l">$click.value$+1</set>
<set token="AttributeConnID">$row.AttributeConnID$</set>
<set token="AttributeANI">$row.AttributeANI$</set>
<set token="AttributeCallType">$row.AttributeCallType$</set>
<set token="AttributeDNIS">$row.AttributeDNIS$</set>
<set token="AttributeCallUUID">$row.AttributeCallUUID$</set>
</drilldown>
<option name="wrap">undefined</option>
<option name="rowNumbers">undefined</option>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">bubble</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">right</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="count">10</option>
</table>
</panel>
</row>
<row>
<panel depends="$tok_ShowEvents$">
<event>
<search>
<query> index=windoesapps sourcetype=Genesys_AvayaTserver earliest=$e$ latest=$l$ | eval x="$tok_ShowEvents$" | rex "(Trc|Adjusted|distribute_event|distribute_user_event|send_to_client|distribute_response):?\s\w+\s(?<EventName>\w+)"| rex "AttributeConnID'?\s'?(?<AttributeConnID>[^\t\n\r]+)"| rex "AttributeANI'?\s'?(?<AttributeANI>[^\t\n\r]+)"| rex "AttributeDNIS'?\s'?(?<AttributeDNIS>[^\t\n]+)"| rex "AttributeCallType'?\s'?(?<AttributeCallType>[^\t\n]+)"| rex "AttributeCallUUID'?\s'?(?<AttributeCallUUID>[^\t\n]+)"| rex "AttributeUserData'?\s'?(?<AttributeUserData>[^\t\n]+)" </query>
<earliest></earliest>
<latest></latest>
</search>
</event>
</panel>
</row>
</form>
... View more
07-28-2016
09:28 AM
I wanted to open data logs on the same dashboard as my table, so if you click on a attribute on the table, it would display that specific data log below. I created an "events" panel and drilldown to the events panel, but right now it's opening all the data logs associated with the table together and I want it such that the logs are only displayed when a specific attribute is clicked on. Anyone know how I can fix this problem?
... View more
07-27-2016
06:26 AM
Is there a way to open data logs on the dashboard from a table instead of re-directing to another page?
... View more
07-26-2016
12:27 PM
yes the prefix will always be the same. Here are a few examples:
08:27:48.526 Trc 01234 RequestDistributeEvent received from [xxx]
06:31:25.488 Trc 01234 RequestDistributeEvent received from [xxx]
09:06:51.846 Trc 01234 RequestDistributeEvent received from [xxx]
03:32:37.964 Trc 01234 RequestDistributeEvent received from [xxx]
... View more
07-26-2016
12:06 PM
that particular query won't work because there are many different event names besides those three mentioned. Is there a way to keep the previous query but add to it so it can display the name for a log that display the event name is this particular way?
7/09/16
7:39:54.235AM 07:39:54.235 Trc 01234 RequestedDistributeEvent received from [xxx]
... View more
07-26-2016
11:19 AM
Also with the time stamp there might be a 10th of a second difference in the logs but Splunk would round it and combine multiple logs. I'm trying to keep the logs separate because rounding the time combines the 2 events within the same time stamp. Example:
7/1/16
7:23:46.846 AM 07:23:46.8460 [0] 4.0.000.00 distribute_user_event: message EventDiverted
7/1/16
7:23:46.846 AM 07:23:46.846 Trc 01234 RequestDistributeEvent received from [000]
So is there a way to keep the date from the splunk time stamp but get the exact time from the log
... View more
07-26-2016
10:57 AM
Sorry didn't realize this earlier. Event names can also be displayed this way.
7/09/16
7:39:54.235AM 07:39:54.235 Trc 01234 RequestedDistributeEvent received from [xxx]
So it doesn't have a specific distribute_event but I need the RequestedDistributEvent to show up as the EventName. Is there a possible way to do this?
... View more
07-26-2016
10:39 AM
Thanks this works! As you mentioned I changed the (? to (?<EventName>...
but like you can see above in the data one is distribute_event and the other is distribute_user_event so would I need to add a or/and statement in between to make sue that the name is displayed given either case
... View more
07-26-2016
07:25 AM
I have a table on my dashboard that displays particular information from logs but I am trying to add an event name to it.
This is how the data appears in my log.
6/7/16
9:31:13.213 AM 09:31:13.2130 [0] 2.1.000.00 distribute_event: message EventAttachedDataChange.
5/30/16
9:30:13.613 AM 09:30:13.6130 [0] 2.1.000.00 distribute_user_event: message EventDiverted
So what I want is to get the distribute_event message as the Event Name. That means on my table there should be an Event Name column and the event name should display "EventAttachedDataChange" or "EventDiverted"
Also currently my logs show 2 timestamps as can be seen above one created by splunk which is the left most timestamp (with the date) and the other timestamp is created when the log is generated (which is right next to the splunk timestamp). Currently my table displays the splunk time stamp and date but is there a way I can keep the date generated by splunk but the timestamp that was generated when the log wad created since that is more accurate.
... View more
07-25-2016
06:51 PM
Hi this is a follow-up question from my previous question. I was able to create a table with specific Id's being displayed on the table. I am now trying to add a search text box that can be used to display information based on specific ConnId's. I was hoping to
create something where a person can view all the connID logs and then using the search box refine the table to a specific connID search. So even when they don't search for a specific connID they are still able to view the table. Any ideas on how I will be able to do this?
... View more
07-22-2016
07:37 AM
Each call is a new file and sometimes there can be multiuple connIDs within one log depending on if the call has been transferred to another person. Here's an example of that.
07:29:13.4760 [0] 1.7.000.23 distribute_event: message EventQueued
AttributeEventSequenceNumber 0000000000007895R
TimeinuSecs 235689
TimeinSecs xxxxxxxxxx (07:29:13)
Extensions [XX] 00 00 00 00..
'UCID' bin: 12 c5 12 63.. (len=8)
OtherDNRole 1
OtherDN '7895230001'
ThisDNRole 2
ThisDN '1234567'
ThisTrunk 14526987
ANI '12356984'
DNIS '4568912'
CallUUID 'ABCD236JO45F22SQH17MODKE789652310'
ConnID 23a74523f123e63b
CallID 14292
PropagatedCallType 2
CallType 2
NetworkCallID 4563289745
ThisQueue '1234567'
AttributeCallState 0
AttributeThisDN 'ex'
ConnID 45632897abdh17r1
OtherDN '4459862'
XRouteType 0
AttributeUserData [xxxx] 00 00 00 00..
'CU_ACT_TY' '1'
'CU_HH_SVC_LVL' '89'
'CU_MLOL' 'Y'
'CU_MLD' 'Y'
'CU_COE' 'Y'
'CU_EMP' '0'
'CU_CLIENTID_TY' 'ACC'
'CU_SEG' '894'
'CU_CLIENTID' '98Z56S78'
'CU_PIN_VALID' 'N'
'CU_REP_FTS' 'Y'
'CU_ML_HOL' 'Y'
'CU_CALL_TY' 'XXX'
'CU_LINE' 'XXX'
'CU_ACT' '98Z56S78'
'CU_XFERCODE' 'ServiceAssociate'
'CU_DNIS_TEST' '5664123823'
'CU_ACT_OPENDATE' '74522369'
'CU_NEWACCT' 'N'
'CU_AUTHID' '0000'
'CU_AUTHLVL' '2'
'CU_EPI' '452361475223'
'CU_ENTITY_CD' '111'
'CU_LOB' 'COS'
'CU_PROD_CD' 'INV'
'CU_TT' 'N'
'CU_1ST_CID' '5ASD0E64-H39K-56W2-5698-145674H1JAL7'
'CU_ROLE' 'CLIENT'
'CU_ANIFND' 'N'
'CU_ANI' '569966245674'
'CU_DNIS' '7895620530'
'ReqType' '3'
'SessionId' '5ASD0E64-H39K-56W2-5698-145674H1JAL7'
'ICRName' 'TellMe'
'CU_FUNCTION' 'FAExtension'
'CU_LANGUAGE' 'English'
'CU_EPI_TY' 'EnterprisePartyId'
'CU_AUTHTY' 'TAXID'
'CU_BRANCHNUMBER' '0000000000'
'CU_NEXTGEN' 'N'
'CU_PBIG' 'N'
'CU_OVRLP_CD' '2'
'CU_ELITECARD' ''
'CU_REQFSA_ACDID' '0000000'
'CU_REQFSA_NTID' '0000000'
'CU_BACKENDOUTAGE' 'N'
'CU_LOGINACCT' '78X32L99'
'CU_COMBOAUTHTY' 'ACCT-TAXID'
'CU_IVR_CALL_ID' 'jekd7sk6aswk7fhabe5d2kl6'
'RoutePoint' '0000'
'DialedNumber' '0000'
'CU_RP' '0000'
'CU_CCDB_TY' 'MLD'
'CU_CONN_ID' '1289652314LKOP15'
'CU_SURVEY' 'Y'
'RVQID' ''
'RVQDBID' ''
'LBR_TS' '452367895'
'LBR_SNUM' '63'
'RTargetTypeSelected' '4'
'RTargetRuleSelected' ''
'RTenant' 'Resources'
'RStrategyName' 'xxxx_MAIN'
'RStrategyDBID' '785'
'CBR-actual_volume' ''
'CBR-Interaction_cost' ''
'CBR-contract_DBIDs' ''
'CBR-IT-path_DBIDs' ''
'RRequestedSkillCombination' ''
'RRequestedSkills'(list)
'CustomerSegment' 'default'
'ServiceType' 'default'
'ServiceObjective' ''
AttributeExtensions [45] 00 00 00 00..
'ISCC_ORIGIN_LOCATION' 'xxxx'
AttributeReferenceID 8956
So basically what I need to create is a dashboard that can be used to search with any given ConnID and it should display the Event name, Event timestamp, DNIS, ANI, CallType, CallUID, UserData (if any, could be listed). I am not exactly sure how to go about this since this is my first time using Splunk. Really appreciate your help!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
