Updating the app
Due to some complexities with Splunk’s DB Connect app, we recommend the following steps if and when you upgrade our Shoretel solution from an earlier version to 1.4.3 or higher
After upgrading to 1.4.3 and restarting Splunk, check whether newly indexed call data is coming in correctly.
- In the Shoretel app navigate to the “Search” page and run the following search:
`cdr_events` | head 1000
- In the results for that search, considering only call data that is dated after the time when you upgraded the app, verify that the timestamp appearing at the start of each event has millisecond-level precision.
If the timestamps do not have millisecond precision, this means that Splunk’s DB Connect app is manifesting a bug where it continues to use the old inputs.conf config. To try to fix this take the following steps:
First navigate to “Settings > Data Inputs > Database Inputs”. You will see a number of database inputs for the shoretel app. Click “disable” on one of them and then some moments later click “enable”. Return to the search above and wait for some some newly indexed events to arrive. Check them as to whether the data format has updated.
If it does not, contact us for additional help.
If you want or need to reindex all the data completely using the new configuration
- shutdown splunk
- run this command from the command line
splunk clean eventdata shoretel -f
- start splunk
- If you experience any problems contact us.