icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading 3CX PhoneSystem app for Splunk
SHA256 checksum (3cx-phonesystem-app-for-splunk_100.tgz) 3d4ef1cce7c6d7dfd87aaa64874cb70ad3944a9176fccdd7811bb80acf100801
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

3CX PhoneSystem app for Splunk

Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
3CX PhoneSystem app for Splunk, contains reach and immersive dashboards to provide proper insights on calls from 3CX phone system.

Splunk App for 3CX Phone System


The Splunk app for 3CX Phone Systems is used to present the 3CX Phone Systems information into Splunk. There are 5 dashboards named Overview and Queue Summary, Agent Logins, Queue Extensions and Call Logs. There are tabs for Reports and Alerts. User can schedule pre-defined report creation and can get it over email. Alerts are generated when there is no data ingested for particular sourcetype.

  • Author - CrossRealms International Inc.
  • Version - 1.0.0
  • Build - 1
  • Creates Index - False
  • Compatible with:
  • Splunk Enterprise version: 8.0, 7.3, 7.2 and 7.1
  • OS: Platform independent
  • Browser: Google Chrome, Mozilla Firefox, Safari


This app can be set up in two ways:
1. Standalone Mode:
* Install the Splunk App for 3CX.
2. Distributed Mode:
* Install the Splunk App for 3CX on the search head. (Required for dashboards.)
* App setup is not required on the forwarder.
* Note: Universal forwarder is not supported.
Create Index named 3cx to store and search the data collected by forwarder.


Follow the below-listed steps to install an App from the bundle:

  • Download the App package.
  • From the UI navigate to Apps > Manage Apps.
  • In the top right corner select Install app from file.
  • Select Choose File and select the App package.
  • Select Upload and follow the prompts.


Data Collection

For data collection we need to setup Splunk DB Connect on Heavy Forwarder.
Deploy Heavy Forwarder by following instructions https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Deployaheavyforwarder
Install Splunk DB Connect app on forwarder.
In Splunk DB Connect, access the Configuration > Databases > Identities tab and click New Identity.
Complete the fields as mentioned below.
* Identity Name : 3CX
* username: phonesystem
* Password needs to be fetched from the 3CX ini file.

Location of the file in various platform is as below.

For Windows : C:\Program Files\3CX Phone System\Bin\3CXPhoneSystem.ini

For Linux: /var/lib/3cxpbx/Bin/3CXPhoneSystem.ini
* From this file look for the stanza name DbAdminREADONLY. Fetch the password from the stanza and fill it in the password field of Identity Wizard.
After Creating Identity Create DB Connections with 3CX PostgresQL.
In Splunk DB Connect, click the Configuration > Databases > Connections tab.
Click New Connection.
On the New Connection page, complete the following fields:
* Connection Name: 3CX
* Identity: Choose the identity 3CX Created in first step.
* Connection Type: Postgress
* Timezone: Select Timezone if required.
* Click on Save.

  • Download the Splunk App For 3CX and extract the archive.
  • From default directory of this App, copy the db_inputs.conf.template file to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/db_inputs.conf
  • Open the file in editor, in the default stanza replace the host value with the hostname you want to add for your forwarder.
  • Restart the Splunk.

Macro Definition Change

Macro definition change is required to improve the dashboard performance. Follow below steps to change the macro definition.
Go to Settings > Advanced search > Search macros.
Change App to Splunk App for 3CX.
Search for default_index and click on it.
Change value in the definition section from index=* to index=<custom-index>. The custom-index is the index which you have selected in Data Collection section while creating DB Connect inputs.
* Final value should look something like: index=main.


To uninstall app, user can follow below steps:
SSH to the Splunk instance
Go to folder apps($SPLUNK_HOME/etc/apps)
Remove the checkpoint_dome9_app_for_splunk folder from apps directory
Restart Splunk


  • NA


Version 1.0.0
* Created App with two dashboards, Insights and Alerts.


  • NA


  • Data collection issue
  • Check Data Collection guide from CONFIGURATION section to make sure Database collection is all good.
  • Verify the data via searching the data with index=<your-selected-index-during-configuration>.

  • Dashboards are not populating

  • Look for the index in which we are indexing the data. If the data is not there in the index then check Data collection issue or else go through second point.
  • Make sure the index is specified in the default_index macro. Check Macro Definition Change guide from CONFIGURATION section for more details.

  • Dashboards are not working as expected.

  • Make sure Javascript is enabled in the browser. Otherwise the Dashboard will not work as expected.


  • Usama Houlila
  • Preston Carter
  • Ahad Ghani


Release Notes

Version 1.0.0
July 28, 2020

The app delivers insights on Alerts and information related to calls on the dashboards.


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2020 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.