The Cisco CDR app contains a simple facility to extract device types based on regex matches against the device names. Many of the ones we ship will work out of the box however most likely you will also have one or more device types that don’t match. This page will tell you how to customize those extractions so as to get all, or nearly all, of these populating. Examples: The most well known example is the “SEP” prefix on hardphone devicenames. This is what the app uses to assign “orig_device_type”, “dest_device_type” to “hardphone”. Another example is the common (but not universal) prefix “CSF” for jabber devices. Note: it’s tempting to call these “extractions” since they are really very simple. However that term implies slightly different config in the Splunk world, and these are called “transforms” so I am using that nomenclature here. To see the existing transforms
To edit an existing transformLet’s say that our default extraction for IP Communicator devices is wrong. Click the transform that says “cisco-cdr-origipcom”. Edit its regex as necessary and then click ‘save’. Now do the same with “cisco-cdr-destipcom”. Note that all of these extractions are in pairs – one for the “orig” side, one for the “dest” side. To create a new transformThis takes two steps. First we “clone” an existing pair. Note the “clone” links next to each extraction. Pick a simple one to clone like “cisco-cdr-destsoftphone” and “cisco-cdr-origsoftphone”. Follow the existing naming scheme of course. After you’ve cloned them, set their regex to match whatever devices you’re trying to extract a type for. (the desktop app “RegexBuddy” is your friend and it may be worth purchasing if you’re going to spend a lot of time on Splunk) You may note that the regex doesn’t actually do anything at this point – nothign is extracted. This is because our transform exists only in a vacuum. It’s not being run yet. To get it to run automatically we have to do step 2. In the breadcrumb link click “fields” and then “Field extractions”. Things to watch out for
If you have any comments at all about the documentation, please send it in to docs@sideviewapps.com. |