Set up Splunk

If you have Splunk in your environment already that is fantastic and you can scroll down to the next section about creating a new index.

Otherwise it’s easy to get a trial of Splunk going.  There are a couple options.

Install a trial of Splunk

First go to and create a new account or log in with an existing account.

  • 60 day trial with multiple Splunk instances, installed locally
    • This is almost certainly overkill!  But not always.  CONTACT US if you think this is the road for you..
  • 14 day trial of Splunk Cloud
    • Go here to start a free 14 day Cloud trial
    • Follow the directions and emails to get it going.
    • If you want to test for longer than 14 days, it is difficult but not necessarily impossible however we recommend talking to your Splunk rep before starting this trial.
  • At this point, you now have a Splunk instance you can log into.

    Create a new index in Splunk called “cisco_cdr”

    If you or your Splunk admins have a preferred way of creating indexes, just do that and get an index called “cisco_cdr”.  If you do not, follow the instructions below.

    • Log into your Splunk instance.
    • Click Settings at the top and then Indexes.
    • Click the green button at the top right that says New Index.
    • Provide a name. We suggest “cisco_cdr”.
      NOTE: if you pick something else, make a note of it. Later in these docs you’ll need to use your choice in some places that will say “index=cisco_cdr”.
    • In most cases, leave the other defaults alone. Change these only if you really know what you are doing (advanced folks might refer to our sizing page).
    • Click Save.

    At this point you will have a Splunk instance that you can log in to and which has an index the data will be saved into later, but it will not have our apps nor any UCM data in it yet.  Next we will install the Sideview Apps.

    If you have any comments at all about the documentation, please send it in to