Skip to main content
Lantern Home
 
 
Splunk Lantern

Monitoring key telecommunications service metrics

  1. Last updated
  2. Save as PDF

 

​Communication service providers (CSPs) and Telcos host a large variety of services, such as voice and VoIP services, and traditional operations support system (OSS) and business support system (BSS) solutions. They face challenges delivering reliable services to their customers in areas outside of the traditional business centers and corporate locations. Providing operational excellence across the business is key to supporting customers while maintaining corporate initiatives and objectives. In your CSP, you need to deploy a scalable data analytics architecture across the breadth of operations. 

 ​Data required

  • Splunk recommends that customers look into using data models, report acceleration, or summary indexing when searching across hundreds of GBs of events in a single search. The searches provided here are a good starting point, but depending on your data, search time range, and other factors, more can be done to ensure that they scale appropriately.   
  • Some commands, parameters, and field names in the searches below may need to be adjusted to match your environment.  In addition, to optimize the searches shown below, you should specify an index and a time range when appropriate.
► Report on general call disposition

You need a search that will give a snapshot of your current VOIP system and may give insight as to where there may exist potential technical issues.

| sourcetype=<call detail records>
| lookup <cdr disposition mapping file> disposition
| stats count values(description) AS Description BY disposition
| rename disposition AS Disposition count AS Count
| table Description Disposition Count
| eval Description=if(match(Disposition,"CONGESTED"),"Route Error",Description)
| sort - Count

Need more help with this search? Click here.

► Report on call failure statistics

You need a search that will give insight into the call failures that your network is experiencing.

| sourcetype=<call detail records>
| lookup <cdr disposition mapping file> disposition
| search disposition="FAILED" OR disposition="CONGESTED"
| stats count values(description) AS Description BY disposition
| rename disposition AS Disposition count AS Count
| table Description Disposition Count
| eval Description=if(match(Disposition,"CONGESTED"),"Route Error",Description)
| sort - Count

Need more help with this search? Click here.

To help with troubleshooting, you may also want to enrich the failed call logs with more descriptive information using the following search:

| sourcetype=<call detail records>
| eval _time = start
| lookup <cdr disposition mapping file> disposition
| search disposition=FAILED OR disposition=CONGESTED
| eval Description=if(match(disposition,"CONGESTED"),"Route Error",description)
| rex field=src "(?<srcCountry>\d+)(?=\d{10})"
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName AS dstCountryName ISO2 AS dstCountryCode
| table _time src dst dstCountryCode Description disposition
| rename _time AS Time src AS "Source #" dst AS "Destination #" disposition AS Disposition dstCountryCode AS "Destination Country"

Need more help with this search? Click here.

You can also organize your failed call reports in several different ways. One of those is by geographic location:

| sourcetype=<call detail records>
| eval _time = start
| lookup <cdr disposition mapping file> disposition
| search disposition=FAILED OR disposition=CONGESTED
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName AS dstCountryName  
| stats count by dstCountryName  
| geom geo_countries allFeatures=true featureIdfield=dstCountryName

Need more help with this search? Click here.

Another is by destination and gateway:

| sourcetype=<call detail records>
| eval _time = start
| lookup <cdr disposition mapping file> disposition
| search disposition=FAILED OR disposition=CONGESTED
| eval Description=if(match(disposition,"CONGESTED"),"Route Error",description)
| rex field=src "(?<srcCountry>\d+)(?=\d{10})"
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName as dstCountryName ISO2 AS dstCountryCode
| stats count values(dst) AS Destination values(disposition) AS Disposition values(Description) AS Description values(_time) AS Time BY partyBiD dst
| rename partyBiD AS "Routed Path"
| table Time Destination Description "Routed Path" count

Need more help with this search? Click here.

► Report on key call metrics

Service metrics can help you with the following business goals:

  • Negotiating lower rates for call traffic or deciding whether to raise your own prices.
  • Creating targeted marketing or campaigns.
  • Reconciling billing.
  • Forecasting capacity and service needs.

Longest and shortest call duration by destination

| sourcetype=<call detail records>
| eval _time = start
| lookup <cdr disposition mapping file> disposition
| search disposition="ANSWERED" OR disposition="BUSY"
| rex field=src "(?<srcCountry>\d+)(?=\d{10})"
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName AS dstCountryName ISO2 AS dstCountryCode
| fields src dst dstCountryName duration
| stats count list(dst) AS dst list(dstCountryName) AS dstCountryName BY duration src
| rename duration AS "Call Duration" src AS "Caller" dst AS "Called Number" dstCountryName AS "Destination Country"
| sort - "Call Duration"

Need more help with this search? Click here.

Countries with the highest and lowest call volumes

| sourcetype=<call detail records>
| eval _time = start
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName AS dstCountryName
| stats count BY dstCountryName
| sort - count
| head 10

Need more help with this search? Click here.

Subscribers with the highest outbound call volume

| sourcetype=<call detail records>
| eval _time = start
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName as dstCountryName ISO2 AS dstCountryCode
| stats count count(dstCountryName) AS dcount values(dstCountryName) AS CountryName BY src dstCountryName
| stats sum(count) AS count list(dcount) AS dcount values(CountryName) AS dstCountryName BY src
| sort - count
| table src dstCountryName dcount count
| rename src AS "Subscriber" count AS "Total Call Count" dcount AS "Destination Calls" dstCountryName AS "Dialed Countries"

Need more help with this search? Click here.

Successful call statistics by geography

| sourcetype=<call detail records>
| eval _time = start
| lookup <cdr disposition mapping file> disposition
| search disposition="ANSWERED" OR disposition="BUSY"
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName as dstCountryName ISO2 AS dstCountryCode
| stats count BY dstCountryName
| geom geo_countries allFeatures=true featureIdfield=dstCountryName

Need more help with this search? Click here.

Total call minutes by subscriber

| sourcetype=<call detail records>
| eval _time = start
| lookup <cdr disposition mapping file> disposition
| search disposition="ANSWERED" OR billable > 0
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName as dstCountryName ISO2 AS dstCountryCode
| fields _time accountcode src billable dstCountryCode
| convert dur2sec(billable) AS calculatedBillableS
| stats values(accountcode) AS Account values(dstCountryCode) AS CalledCountries sum(eval(round((calculatedBillableS/60),0))) AS BillableMinutes BY src
| nomv CalledCountries
| rename src AS "Caller" BillableMinutes AS "Billable Minutes"
| table Account Caller CalledCountries "Billable Minutes"
| sort - "Billable Minutes"

Need more help with this search? Click here.

► Predict call revenue

You need a search that will associate a monetary value to each successful call and get an estimated total daily revenue stream to assist in informed decisions about capacity, billing rates, services, and marketing campaigns.

| sourcetype=<call detail records>
| eval _time = start
| lookup <cdr disposition mapping file> disposition
| search disposition="ANSWERED" OR billable > 0
| rex field=dst "(?<dstCountry>\d+)(?=\d{10})"
| lookup <country code to name mapping file> phoneCode AS dstCountry OUTPUTNEW countryName as dstCountryName ISO2 AS dstCountryCode rateFirstMinute rateMinute
| fields _time accountcode src billable dstCountryCode rate*
| convert dur2sec(billable) AS calculatedBillableS
| eval billableMinutes = calculatedBillableS / 60
| eval billableMinutes = ceiling(billableMinutes)
| eval billableMinusOne = billableMinutes - 1
| eval totalBillable = rateMinute + (billableMinusOne * rateMinute)
| stats sum(totalBillable) AS CallRevenue

Need more help with this search? Click here.

Next steps

The insights provided from these searches reach multiple areas of your business. The searches related to failed calls and provide insights for monitoring, alerting, and troubleshooting. Searches related to call duration and volume can help with setting rates, targeting marketing campaigns, and forecasting capacity and service needs. You can also use the results to more effectively troubleshoot and resolve ongoing issues. If you discover anomalies, operationalize them as alerts or actions.

These additional Splunk resources might help you understand and implement this use case:

Splunk OnDemand Services: Use these credit-based services for direct access to Splunk technical consultants with a variety of technical services from a pre-defined catalog. Most customers have OnDemand Services per their license support plan. Engage the ODS team at [email protected] if you would like assistance.