Oracle SBC CDR

If you use either Oracle Session Border Controller (Oracle SBC) or Oracle Session Router, contact us today about potentially integrating this data today so that you can drive around in this data in the same ​“Investigate Calls” interface that you use for CUCM CDR.

Setup is relatively simple and leans on Oracle SBC’s documentation for setting up ​“Local CDR Storage and SFTP Push”. But here below are the full steps start to finish. 

Install the Sideview apps

This involves two additional apps developed by Sideview:

1. TA_​oracle_​sbc_​cdr aka ​“Supporting Add-on for Oracle SBC CDR”, available on Splunkbase here.
2. SA_​oracle_​sbc_​cdr aka ​“Supporting App for Oracle SBC CDR”, also available on Splunkbase. Note this second app is distributed under a time-limited trial license.

Why are there two? Basically it makes app installation and updates easier for Splunk admins. 

The TA is to be deployed to your Indexer tier. The only exception is if you are using a Heavy Forwarder to forward ​“cooked” data to your indexers, in which case it should be deployed on that HF instance.

The SA is to be deployed on your Search Head, by your method of choice. On non-clustered Search Heads the easiest way is via Splunk’s in-product install (Apps > Manage Apps > Browse More Apps)

Setting up the SFTP side

Unless you have a strong reason not to, we recommend using the same SFTP server that your CUCM CDR comes into. We strongly recommend creating a different subdirectory to hold the Oracle SBC CDR files. Pick a subdirectory name, create the subdirectory on the server (you can use an SFTP client or log into the box itself) and remember that subdirectory name as you will need it in the SFTP steps later.
 

Steps on the Oracle side

Here are really the main steps and we defer to the Oracle documentation. Note that we strongly recommend using their cdr-output-inclusive parameter.

Verifying whether it’s working

At this point you should see the files building up in the subdirectory since we haven’t created a data input yet to whisk them away. Check to make sure the files are coming in. 

Creating the data input

If you’re ingesting CUCM CDR data and using the same SFTP server, stay on that track and create this stanza in the same the same inputs.conf file that’s sending in your CUCM CDR and CMR data.

Here is an example of the inputs.conf entry you will need to add to the file. 
 

[batch:///home/username/cisco_cdr_data/oracle_sbc/*.txt]
 sourcetype = oracle_sbc_cdr
 index = cisco_cdr
 move_policy = sinkhole

After adding that stanza, restart that Splunk instance.

Next log in to Splunk, navigate to the Cisco CDR app and to ​“Admin > Enable/​Disable Data Types”. You should now see Oracle SBC as an option in the dropdown. Select ​“Oracle SBC” and it should now also appear in the table. Finish this step by submitting the form to enable the new data type.

Now return to the Investigate Calls page, and you should see a new pulldown option titled ​“through” that has both ​“CUCM” and also ​“Oracle SBC”. You can leave both selected or pick just one at a time. Note that the fields available in Oracle SBC data have some overlap with the CUCM field names, but generally the space of fields is different so you will have to experiment with the ​“Edit Fields” button. Have fun and let us know what you think !

Of course if you have any problems or if we seem to have missed something in these docs, please do reach out to us at any time. 

ADVANCED NOTE: it is possible that your Oracle SBC instance has a very slightly different set of fields than what our code expects to see, even if you have used the ​“cdr-output-inclusive” parameter. If so, this is quite easy for us to fix after you set it up, but if you prefer to talk to us first and send us a snippet of your data we can certainly do that.