Ingesting data from UCCX

Prerequisites

Have Splunk installed, and be sure a reasonably recent version of DB Connect is installed (I’m using the latest, 3.16). This will necessitate java, but you can find information about all that in Splunk’s documentation for DB Connect.

1) UCCX setup steps

Set or enable the password in UCCX for the uccxhruser by navigating to Unified CCX Administration menu bar > Tools > Password Management > Historical Reporting User and setting it. Remember this password, obviously. Also create an index​‘cisco_​uccx’ using whatever method you need to use for your system.

Collecting information needed later

1. Log into your Cisco Unified Intelligence Center Express Reporting.

2. Depending on your version, click either ​“Data Sources” on the left, or ​“Configure” then ​“Data Sources”

3. Edit the UCCX data source

4. Note the Datasource Host, Port, Database Name, and Instance for use later.

2) Installing and Preparing Splunk DB Connect

1. Install the DBConnect app into Splunk. The preferred way to do this may be different on your Splunk deployment (consult your Splunk admins if you’re not one of them), but generally you got o Apps > Manage Apps > Find More Apps, and then search for ​“DBConnect”, then click ​‘install”
2. Download the Informix jdbc connector, version 4.50.11
   

   1. Informix is not (as of this writing) listed in ​“Other Supported Databases” section of the Splunk DBConnect docs, but this may change in the future: https://​docs​.splunk​.com/​D​o​c​u​m​e​n​t​a​t​i​o​n​/​D​B​X​/​l​a​t​e​s​t​/​D​e​p​l​o​y​D​B​X​/​I​n​s​t​a​l​l​d​a​t​a​b​a​s​e​d​r​ivers

   2. This link to mvn​repos​i​to​ry​.com may help — https://​mvn​repos​i​to​ry​.com/​a​r​t​i​f​a​c​t​/​c​o​m​.​i​b​m​.​i​n​f​o​r​m​i​x​/jdbc
      And the IBM site also has a topic on this: https://​www​.ibm​.com/​d​o​c​s​/​e​n​/​i​n​f​o​r​m​i​x​-​s​e​r​v​e​r​s​/​1​4​.​1​0​?​t​o​p​i​c​=​s​t​a​r​t​e​d​-​o​b​t​a​i​n​-​j​d​b​c​-​d​river )

   3. A little digging in there will net you a ​“files” download for jdbc‑4.50.10.1.jar

3. Once found, drop the jar file into the $SPLUNK_​HOME/​etc/​apps/​splunk_​app_​db_​connect/​drivers folder, go to the Splunk DB connect app, Configuration, Settings, Drivers and click reload. (Or just restart Splunk).

   You can read Splunk’s documentation linked above for more general info on DBConnect and how to deal with drivers.

4. Restart Splunk
   

3) Create Identity and Connection inside DBConnect

1. Inside DBConnect, in Configuration/​Databases/​Identities, create a New Basic Identify using 

   • Name — UCCXUser

   • User — uccxhruser

   • Password — the password you assigned to your uccxhruser above.

2. Create a new connection to your UCCX box. 

   • Name the connection​“UCCX”

   • Pick your UCCXUser Identity that you created in step 1 of this section.

   • Use a connection type of Informix

   • Pick the appropriate timezone.

   • From the UCCX data source values, enter

     • Host == ​“Datasource Host” field

     • Port == ​“Port” field (probably 1504)

     • Default Database == ​“Database Name” (probably db_cra)

     • Informix Server == ​“Instance” field

4) Testing the connection

You should now be able to, in DB connect, switch to the Data Lab, then to the SQL Explorer.

Pick your connection UCCX, the Catalog db_​cra, and select one of the tables with data, like contactcalldetail. After giving it a few seconds (or minutes) you should see data populate.

5) Install the (as of this writing unreleased) SA_​cisco_​uccx app from Sideview

1. Copy db_inputs.conf to splunk_​app_​db_​connect/​local
2. Restart Splunk
3. Back in DB Connect app, Data Lab, Inputs
4. Click on the first one…
5. “Unlock & Edit” the Checkpoint Value (lower right), click away the warning.
6. Click ​“Execute SQL” in the upper right.
7. Next
8. Finish
9. Back to list…
10. Then ​“Enable” that input.
11. Repeat for the rest.