Supporting App for AXL | Installation Notes
2 - Install and Configure the App
Important note!
You need to have an on-prem Splunk Instance to run the Supporting App for AXL.
- If you are in Splunk Cloud and you do not have this set up yet, start in the Splunk Docs for using a Heavy Forwarder to get data in.
- If you are in Splunk Enterprise, then don’t worry. When we say “on prem Splunk Instance” we just mean your local Search Head.
Install the Supporting App for AXL into Splunk
- Log into the on-prem Splunk instance mentioned above.
- Get to the Manage Apps page – either using the Apps menu at the top left of most pages in Splunk, or by going back to the “Launcher” app and clicking manage apps at the bottom left.
- Click the green button to Browse more apps in the upper right.
- Search for Sideview and you’ll see the Supporting App for AXL listed, click on it.
- You should be able to just click “Install” and it will prompt you to restart Splunk after. If you see the app from that page but you don’t seem to be able to Install it, please contact us.
- Note also that your password here is your Splunk.com password, not your local system’s password.
- ALTERNATIVE: If your Splunk admins have locked down your instance such that it can’t talk to Splunkbase, then you can download the tar.gz direct from Splunkbase and save it locally. Then in that same “Manage Apps” page from above you’ll see an “Install App From File” button. Click that and follow the prompts.
Install the Supporting App for AXL app’s AXL Toolkit Files
Note: We will refer to the directory in which Splunk is installed as “$SPLUNK_HOME”. On Linux this is generally “/opt/splunk/” whereas on windows it is generally “C:\Program Files\Splunk\”.
- Copy the three files AXLAPI.wsdl, AXLEnums.xsd and AXLSoap.xsd from the temporary directory where you extracted them before, to your $SPLUNK_HOME/etc/apps/SA_cisco_cdr_axl/bin/ folder on the on-prem Splunk instance where you’ve installed the app.
- They can be deployed via most other “generally accepted” Splunk deployment methods as well – deployment server, deployer, puppet, etc…
- Restart Splunk! (specifically the on-prem splunk instance)
Note for folks with multiple CUCM clusters: If you have multiple clusters with different CallManager versions that you are going to use with AXL, you’ll need to repeat the steps above for the additional AXL toolkit files.
- You can leave one set in the base $SPLUNK_HOME/etc/apps/SA_cisco_cdr_axl/bin/
- For each of any others you need, create a directory with an appropriate name like $SPLUNK_HOME/etc/apps/SA_cisco_cdr_axl/bin/12.5 and put the new files there.
Configure the Supporting App for AXL app’s AXL credentials.
- Log into the on-prem Splunk instance.
- Click Apps and then Supporting App for AXL to navigate to the AXL app.
- Click Update credentials at the top.
- Enter the publisher host, the port (generally 8443) and the username and password for the AXL user you created previously.
- Click Create to create the credentials.
Note for folks with multiple CUCM clusters: The AXL app’s credential user interface unfortunately doesn’t give you a way to set the wsdl_directory key in ciscoaxl.conf, so you will have to make that change by hand in ciscoaxl.conf. You can look in $SPLUNK_HOME/etc/apps/SA_cisco_cdr_axl/README/ciscoaxl.conf.example to see how to enter the version-specific wsdl path for each cluster.
Configure the Clusters setup in the Cisco CDR app
One of the only steps you need to perform in the Cisco CDR Reporting and analytics app —
- Log into your main Splunk instance (the Cloud instance if you’re on Cloud)
- Click Apps and then Cisco CDR Reporting and Analytics to navigate to the Cisco CDR app.
- Click App Settings in the grey navigation bar, and then Clusters and locales
- On that page’s “About” tab, confirm the list of clusters looks current and correct, then click the Push to CSV button.
- Click the Edit/Delete Clusters tab and wait a moment for its contents to load.
- For each cluster in the list,
- edit the “axlHost” field and paste in the same publisher host as you used when configuring that publisher’s credentials above. (No port or other information, just the FQDN, IP or short hostname of the host so that it matches).
NOTE: The case must also match exactly.
NOTE: Do not alter the value of the ‘clusterId’ field. - Click the “Update” button for that row.
- Repeat for each cluster.
- edit the “axlHost” field and paste in the same publisher host as you used when configuring that publisher’s credentials above. (No port or other information, just the FQDN, IP or short hostname of the host so that it matches).
Testing
Try the following to confirm everything is set up correctly:
- Go to your “on prem Splunk instance” (see the section at the top for what we mean)
- Click Apps and then Supporting App for AXL to switch to that app.
- Click on Search in the grey navigation bar.
- Use one of the following two searches to test with.
- If you have hardphones, try:
| ciscoaxl listPhone name="SEP%" columns="name,description"
- If you have only jabber devices, try
| ciscoaxl listPhone name="CSF%" columns="name,description"
- If you have hardphones, try:
If all is set up correctly, in a few moments (maybe minutes!) you should be presented with a list of all hardphones or jabber devices.
NOTE if your CUCM deployment is enormous you might want to filter that test down to a smaller subset of phones by changing “SEP%” to something more targeted. For instance “SEP0123%” will only match hardphones phones that have MAC addresses starting with “0123”. Or something like “CSF*” would find all Windows Jabber clients.
Next Steps
The last step is to Populate the devices lookup.
Related
Have your cake and eat it too! Trust Webex with your calls, but pull all the metadata into Sideview's app in Splunk, for ad-hoc investigation, charting and flexible dashboards.