All Apps and Add-ons

CDR file of huawei CSOFTX3000

ryainad
Explorer

I have CDR file of huawei CSOFTX3000, and sample with first 50 decoded CDRs.

What I need to do is to get all information from CDR files and save in database or even .txt files (doesn't matter where).

I found and want to use a tool in perl Splunk Huawei CSOFTX3000, but I don't know does it work with my file?

0 Karma
1 Solution

dmillis
Splunk Employee
Splunk Employee

There is a longer discussion of how this perl script works here: http://blogs.splunk.com/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles/

You can test the perl script with your logfile from the command line:
1) Change directory into $SPLUNK_HOME/etc/apps/Splunk_HuaweiCsoftX3000/bin
2) cat <your Huawei binary logfile name> | ./huawei2text.pl

You should see a lot of single-line records, something like this:
2010/12/04 00:07:38 Serial_Number="2147529748",Serial_Number_in_module="20980895",Module_Number="52",CDR_type="PDSN_BILL",Charge_start_time="2010/12/04 00:07:38",Caller_party_number= ...

The Serial_Number fields should be incrementing with each record.

If you do NOT see this, or the values look weird, or the Serial_Number values aren't successive, you may have Huawei logs which have a record length different than 350 bytes; this perl script is designed to work with a 350-byte record length.

View solution in original post

dmillis
Splunk Employee
Splunk Employee

There is a longer discussion of how this perl script works here: http://blogs.splunk.com/2011/07/19/the-naughty-bits-how-to-splunk-binary-logfiles/

You can test the perl script with your logfile from the command line:
1) Change directory into $SPLUNK_HOME/etc/apps/Splunk_HuaweiCsoftX3000/bin
2) cat <your Huawei binary logfile name> | ./huawei2text.pl

You should see a lot of single-line records, something like this:
2010/12/04 00:07:38 Serial_Number="2147529748",Serial_Number_in_module="20980895",Module_Number="52",CDR_type="PDSN_BILL",Charge_start_time="2010/12/04 00:07:38",Caller_party_number= ...

The Serial_Number fields should be incrementing with each record.

If you do NOT see this, or the values look weird, or the Serial_Number values aren't successive, you may have Huawei logs which have a record length different than 350 bytes; this perl script is designed to work with a 350-byte record length.

ryainad
Explorer

I have tested with logfile, 1st record is decoded right, but others are wrong.
It seems I have a record length different than 350 bytes. How to know record length?
I have documentation, but there is description for all record length.

And How can I change this app to my decode my logfile?
Thank you in advance!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...