Shorten your time to useful information!
This video was designed to have a very fast return on your few minutes of investment.
If you’ve watched this all the way through and still can’t figure out how to build your own, specific report – let us know! We’d be happy to help!
We start out with a brief tour of the home tab, and how to launch and customize sample reports.
We then follow that with finding and viewing calls, filtering data, and viewing call details.
And finally use the set of calls we find above to build some reports.
Hi. This is Rich from Sideview. Today we’re going to take a whirlwind tour of the cisco cdr reporting and analytics app. I’ve started on the home page because that is where one starts. You’ll notice at the bottom we have a list of all the fields that are either in your data directly or ones that we’ve created with the app to make your life easier. There are descriptions and the field names and everything and this is searchable, we’ve also broken it out into areas, too. So keep this in mind as you’re poking around your data if you ever need to figure out what something means here’s where you’d go for it. In many cases we also have a sample report associated with the field. For instance we build this field “call_failed” which just kind of rolls up all the cause descriptions that would indicate a call has failed and with it we have a sample report, so let’s give a click on that and see what it looks like.
So now that we’re here in general report you can see there’s been no number filtering set here, it’s over the last 24 hours which of course you can change any way you want, for all call types, and that it’s added the search filter of “call_failed=1”, We’ve created the distinct count of calls over time report which is really just a call volume report for those failed calls split by the cause description so each one of these columns is the stacked up cause descriptions.
And of course this is just the starting point you can make any sort of customization to this that you want.
For instance we could … let’s remove the split by to none so now it’s just a call volume report of those failed calls and let’s do over the cause_description.
And for instance in this case i think it might look better as a bar. OK, so let’s go back to the home tab and let’s build this chart from scratch – you’ll find it’s really easy and very instructive.
Our first job is to find the data that we’re looking for there’s a couple of ways to get to your data and the calls you can click one of these bars over here which would take you straight to that day’s data. It is adjustable – you can do some fiddling around with these and pick different time frames but it’s a relatively simple interface and a quick way to just get started with a particular piece of data. Or you can go in from browse calls – you’ll notice these other menu items here they’re all very interesting in their own right and very useful we’ll be covering those in other topics – for now let’s just pick browse calls. So here we see browse calls with the default fields showing. This is filterable by numbers, you can either click on them down here if they’re visible, for instance the only calls to or from this number.
We could change it to calls to that number only. The time frame is of course selectable and you can pick different call types if you wanted.
The number field also supports comma separated lists of numbers and the star as a wild card. For instance here we can search for 1403 or where it’s starts with 503580. Let’s see what that gets us.
And there they are you’ll notice also by default we do cradle to grave reporting we roll up all the individual call legs into calls because that makes a lot more sense for most reports and most searching. If you wanted to see more details on any one of these you can click on the row and viewed full details about this call.
Down at the bottom there is our quality information if such was sent in, a list of other calls to and from this party and a variety of other information here. This is also worth noting that in the upper right hand pane of the call detail page is a place where you can go and really put this call up on blocks. We click edit fields there add them all and click apply.
Then you can walk through every field that’s in this call and see what’s going on.
And it could take a few minutes so i won’t go through them all. In any case let’s go back to browse calls (you can either use your browser’s back button or click in the crumb bar) and you’ll notice that our filtering is still applied. So let’s remove this and start building our call failed report.
So we’re going to have no filtering for numbers – let’s do yesterday it’s always nice to see a full day’s worth – for all call types and now we need to figure out what to put in our search filters. So let’s go over and click edit fields and add the “call_failed” field. And this list is filterable here too so we can just start typing in part of the field name to find it quicker. We’ll add in “call_failed”, we’ll move it up near the top and you can add any fields you want in here as many as you want – it might get a little messy and filled up looking but you know it’ll work fine. And then let’s apply our change so now we can see the “call_failed” field as well. And there they are so in the last few minutes worth of data I have here there weren’t any failed calls. So how are we going to filter for where they were failed? Because if I click on this I can only add “search for call failed equal 0”? Let’s do that I’ll show you a trick.
This is just a text field – we can just change it. We know we’d want to see ones so we change it and press enter and there they are. Alternately let’s remove that real quick…
you could have also
sorted the “call_failed” field directly by clicking on the column header and finding the value you want. Search for “call_failed=1”.
So here’s a list of failed calls this alone might be good information for somebody. You can create a dashboard panel out of it or save a report or even provide this URL to somebody else who can log into Splunk and access our app and they should be able to see the same data.
If you had any particular cause descriptions in here that you didn’t want to include, like for instance you decided that the precedence call blocked is not your problem and you don’t want to report on it, you could add that as an exclusion. Click on it and say exclude where the cause description equal whatever that value is.
And then you’ll get a new list that has both of those criteria – they are where they’re failed, but where it’s not the precedence call blocked. I don’t really want to do that right now so I’m going to just erase that from up here. You can also click in the cause description and change it from there too.
So now that we have the data showing that we want to actually build the report from we’re going to click this link right here “graph calls over time”.
It’s almost hidden considering how important it is but what this will do is send us over into general report with all of our filtering set. So you can see it’s still on yesterday, our numbers would have followed us over if we had any set, same with call types
but our search filter “call_failed=1” definitely came across and then as you saw before we’re in the distinct count of calls over time with no split by. That’s just the default report that shows up. If you’ll remember just a little bit ago right over here this link said “graph calls over time” and led us to here. You’ll notice now it’s changed to see calls. Clicking this would simply take us back to browse calls with whatever happens to be showing down here displayed. You can also drill into a particular time slot either “chart these calls over time” which will just zoom this all into that one little time slot or we can click browse these calls
and now notice we’ve zoomed way in on our time until it’s just showing a 10 minute period with the calls we had selected. In any case we’re going to click the browser’s back button to get back where we were and resume building our report.
So to build the call failed report we saw before we’re just going to change our split by, then drop this down,
find cause description,
and there it is. While we’re in here there’s a lot of other options for aggregation we can do as well. Some of these won’t make sense with a call failed report so let’s just show call volume report.
Now we’re still splitting by cause description that’s fine we can leave that for now and let’s try something more interesting.
Let’s try choosing the max as our aggregation. You’ll notice it immediately changed it away from max calls to duration. For our purposes of a new report what I’d like to do is show the concurrency involved though so let’s scroll down to concurrency
there it is
and now you can see we have a concurrency report over that same time period for the number of concurrent calls split out by cause description. We don’t need to split it by cause description – in this case that may be useful to you might not
so there’s our max concurrency without being split by we could even split it by, say, site.
If you’ve set up sites, groups or anything else in here you can use those as first class citizens so here I’ve set up us backup site headquarters the main call center and a couple of others and so now we’ve just split our concurrency report up by the site.
Let’s go back to it call volume report
and see our call volumes by site in fact let’s remove the split by
and make it over site
And there’s our number of calls for yesterday per site.
In any case I hope you enjoyed this video it’s all I’ve got for you today. Stay tuned for some more specific videos on the various other menu items here and a couple of others inside here as well. Thanks for watching.
If you have any comments at all about the documentation, please send it in to firstname.lastname@example.org.