Supporting App for AXL | Installation Notes
3 - Populate Devices
Splunk Cloud initial step
If you are in Cloud, create a new and separate index in your cloud environment. A suggested name is cisco_cdr_app_lookups. You can use a different name here, but if you do contact us for other changes to make!
Everyone continue here
- Log into your on-prem Splunk instance.
- Click Settings at the top, then Searches, Reports and Alerts.
- Change to “All” apps, change the “owner” to “nobody” or “All”, and then ‘filter’ for “get_devices_example”. It should find a single search called “get_devices_example”.
- For that search, click Edit and then click Clone.
- Name your newly cloned search “get devices via axl” or something similar. click Clone report.
- Click View to and then on the resulting screen click Enable Report to enable it.
- Click Run to run the search. It may take a minute or a few minutes.
- Confirm it returns fields like productName, and remember it might take a few moments for it to return data. Just be patient.
Edit the search (Edit > Open in Search)
Next, if you are using Splunk Enterprise (on-prem),add this one additional line to the end of the search:
| outputlookup create_empty=false override_if_empty=false devices- Run that search once again to populate the devices lookup for the first time.
OR, if you are using Splunk Cloud:
- First look at the last line of the big search that you opened. You will see a “table” command and a list of fields.
- Look for a field in that list, called “clusterId”. Replace “clusterId” with “axlHost”.
Next add this 3 additional lines on the end:
| eval lookup_name="devices" | eval _time=now() | collect index=cisco_cdr_app_lookups
- (Everyone continue here) Save the altered search now, with other settings left at their defaults.
- When the confirmation that the report is saved pops up, you can click the link to “Schedule report” then skip to the next section, step 2.
Scheduling the AXL search
Go back to Settings > Searches, Reports and Alerts and search for the version of the report you built in the previous step. Once found:
- Click Edit, then Edit Schedule for that report
- Enable the checkbox to Schedule Report
- Change the settings to suit your needs. We recommending Run every day at 1:00 or 2:00.
- Click Save.
Splunk Cloud final steps
If you are using Splunk Cloud, we need to create the lookup from the AXL data we’re sending to it.
- Log into your Cloud environment.
- Click Settings at the top, then Searches, Reports and Alerts.
- Create a new report with a Title like Generate AXL lookup.
Paste this into the search field
`custom_lookup_index` lookup_name="devices" | eventstats max(info_max_time) as latest | where info_max_time=latest AND info_max_time>relative_time(now(),"-24h") | eval lastUpdated=latest | lookup clusters axlHost output clusterId | table name, productName, department, description, className, subclassName, devicePool, mailId, userFullName, userId, callingSearchSpaceName, protocol, securityProfileName, directoryNumber, clusterId, lastUpdated | outputlookup override_if_empty=false create_empty=false devices- Use -24h for the earliest time, ignore the latest time or use “now” if you like.
- Turn the Time Range Picker option to No
- Save it in the Cisco CDR Reporting and Analytics app
Once it returns you back to the Searches, Reports and Alerts page,
- Search for your saved report (you will be the owner of this report)
- Click Edit, then Edit Schedule.
- Schedule the report to run Every day, ideally either one or two hours after the on-prem search runs (so at 2:00 or 3:00 AM)
And for one last easy step, once it returns you back to the Searches, Reports and Alerts page,
- Search for your saved report if it’s not displaying
- Click Run to run it once.
Next Steps
Now that you have the Devices lookup set up and enabled, there will be a few more fields available to you for use everywhere in the app. You can read about them in our page on Using Devices. Or drop us a line and we’d be happy to hop on with you and show you around what you now have — there’s more there than may first meet the eye.
Related
Have your cake and eat it too! Trust Webex with your calls, but pull all the metadata into Sideview's app in Splunk, for ad-hoc investigation, charting and flexible dashboards.