Splunk Search

Read Asterisk CDRs

haonanzhang98
New Member

I have Ubuntu 10.10 running Asterisk 1.6.

I want to use Splunk to index the Asterisk CDRs. It's one of the automatically supported filetypes. The CDR is located at /var/log/asterisk/cdr-csv/Master.csv.

I added it to the list of directories to monitor. It shows up as a source, but it doesn't index any events. It just says events indexed 1.

From the CLI, I have to use sudo cat /var/log/asterisk/cdr-csv/Master.csv to view it. Could permissions have something to do with it? Although I did start splunk with sudo...

Tags (1)
0 Karma

mloven_splunk
Splunk Employee
Splunk Employee

If you run a search for:

index=* source="*Master.csv"

Do you get any results back? I suspect that since you're seeing one event, Splunk indexed the file, but it probably saw it as one huge log entry.

Also, how did you set up the input? Through the GUI? Did you specify a sourcetype?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...