I'm pretty sure this is going to be very obvious but it's one of those days again. I've a field Duration_Seconds to establish length of calls going through the system. I'm trying to display say the top 20 longest calls, however, whatever I try, it basis the results on total count, not length. So even if I have a hundred calls at 30 seconds long that's not what I'm after, I,m after the individual call at 12257 seconds, 10545 seconds, 10140 seconds etc. However, if I have 5 calls at 900 seconds, I still need to see those as separate instances. Does that make sense? The search I'm using is: host=*|search Code_Dialled=9 Duration_Seconds=* |sort - "Duration_Seconds" which gives me it as a search, it's the last bit I'm stumped on. Thanks again, Stu.. ... View more

Hi, still finding my around Spplunk and I've sort of go what I want in pt2 of my requirements, but after a couple of days, I'm just going around in a spin. I'm trying to split up the raw data from an Avaya CM. I've go it coming in, managed to break each entry into a single line but then I get stumped trying to break it up further using the Extract Fields. I presume I need to ad this to either props or transforms, but at a loss what I need to enter. The Avaya data comes in a fixed format such as: and so on. Using rex101 I created the expression ^(.{6})\s(.{4})\s(.{5})\s(.{1})\s(.{4})\s(.{4})\s(.{18})\s(.{15})\s(.{4})\s(.{7})\s(.{3})\s(.{3})\s(.{11})\s(.{5})\s(.{15})\s(.{2})\s(.{6}) which seems to work pefectly in the test. However I'm at a complete loss as where to go next so that each field is split up and named. I've always used the Field Extraction tool, but it's the 1st time I've tried using my own, as opposed to standard delimiters. All that I get is a tick next to my values, but can't do anything from there. Sure it's something pretty simple, but I'm just stumped. Thanks once again Stu.. ... View more

Hi hope someone can help. I'm new to Splunk and can see it's potential for what I require, but I'm struggling to get some XML's to format correctly. I've looked at loads of example answers, but none of them see to make the xml easily readable, I've a feeling when trying to apply examples, because the word "call" appears so often, it's messing up the result. I've trying multiple examples in props.conf and transforms.conf, but seems to have little effect What I'm trying to achieve is the info between <call> and </call> (not calls and calls) to appear on an combined line and "discard" the rest. At the moment it all seems to be a little bit all over the place. Any help would be really, really appreciated. Hopefully once I can get the basics done, I can progress onto a nice set up anyone can use. <?xml version="1.0"?> <calls> <call> <call_time>2017-03-27T15:46:38+01:00</call_time> <duration>PT50.189S</duration> <condition_code>9</condition_code> <parties> <dialed_number>[email protected]</dialed_number> <calling_number>[email protected]</calling_number> </parties> <sip_entities> <terminating>NNNLISBCE</terminating> <originating>UKDCNNNNNNN</originating> </sip_entities> <feature_flag>4</feature_flag> <bcc>M</bcc> <ma_uui>0</ma_uui> <resource_flag>0</resource_flag> <bandwidth>1</bandwidth> <av_gsid>007651bf-NNNN-4701-NNNN-57c36b590000</av_gsid> <ip_addresses> <calling>192.0.0.50</calling> <called>192.0.0.51</called> </ip_addresses> <usage> <voice>Y</voice> <video>N</video> <fax>N</fax> <text>N</text> <other>N</other> </usage> <codec>8</codec> <tenant_ids> <calling></calling> <called></called> </tenant_ids> </call> <call> <call_time>2017-03-27T15:46:53+01:00</call_time> <duration>PT19.737S</duration> <condition_code>9</condition_code> <parties> <dialed_number>*[email protected]:5060</dialed_number> <calling_number>[email protected]:19937</calling_number> </parties> <sip_entities> <terminating>UKDCNNNNNN</terminating> <originating>RONNNNNNN</originating> </sip_entities> <feature_flag>4</feature_flag> <bcc>M</bcc> <ma_uui>0</ma_uui> <resource_flag>0</resource_flag> <bandwidth>1</bandwidth> <av_gsid>2a774e90-NNNN-11e7-NNNNN-f8bc125544b0</av_gsid> <ip_addresses> <calling>192.0.0.50</calling> <called>192.0.0.55</called> </ip_addresses> <usage> <voice>Y</voice> <video>N</video> <fax>N</fax> <text>N</text> <other>N</other> </usage> <codec>8</codec> <tenant_ids> <calling></calling> <called></called> </tenant_ids> </call> </call> </calls> ... View more