Splunk Search

Splunking traditional IT + Telco devices/systems/infrastructure

donnylie
Explorer

I don’t have any background in Telco world, I’m so blank about it,

Telco people asked this many times,

is it possible to Splunk from traditional IT and telco world/devices/systems? So they can have new insights/BI/OI/management/… so on combined from both world…

How deep Splunk can Splunk to this telco world?

[This question also consider legacy and recent tech telco, if I'm not mistaken Telcos are attempting to go to IP based, but again, I don't have background in Telco, I'm not sure]

Thank you very much,

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Unfortunately, the answer is a lot of "it depends".

Splunk is obviously great at getting data from all sorts of traditional IT systems via either a direct network connection, or a forwarder looking at a log file.

Some telco equipment is easy, if it is already based on an existing 'server' architecture. For example, Avaya used to make a Call Management System that was mostly just software on a solaris box. That's easy, load a forwarder and go.

But, a lot of stuff is going to be a lot more difficult. Some of these devices have limited, if any, TCP/IP support. Many of them are old enough to simply have a "Craft" RS-232 port where they would hopefully log alarms.

One thing you might consider is using a small terminal-server style device to bridge the gap. I think you can use something like a Digi Portserver - it can be configured to connect to a TCP host/port and basically dump everything coming in over the serial port. And they aren't too terribly expensive - you could buy a small one (4 port) to test with for a couple hundred bucks I think.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...