The Splunk app for 3CX Phone Systems is used to present the 3CX Phone Systems information into Splunk. There are 5 dashboards named Overview and Queue Summary, Agent Logins, Queue Extensions and Call Logs. There are tabs for Reports and Alerts. User can schedule pre-defined report creation and can get it over email. Alerts are generated when there is no data ingested for particular sourcetype.
This app can be set up in two ways:
1. Standalone Mode:
* Install the
Splunk App for 3CX.
2. Distributed Mode:
* Install the
Splunk App for 3CX on the search head. (Required for dashboards.)
* App setup is not required on the forwarder.
* Note: Universal forwarder is not supported.
Create Index named 3cx to store and search the data collected by forwarder.
Follow the below-listed steps to install an App from the bundle:
Apps > Manage Apps.
Install app from file.
Choose Fileand select the App package.
Uploadand follow the prompts.
For data collection we need to setup Splunk DB Connect on Heavy Forwarder.
Deploy Heavy Forwarder by following instructions https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Deployaheavyforwarder
Install Splunk DB Connect app on forwarder.
In Splunk DB Connect, access the Configuration > Databases > Identities tab and click New Identity.
Complete the fields as mentioned below.
* Identity Name : 3CX
* username: phonesystem
* Password needs to be fetched from the 3CX ini file.
Location of the file in various platform is as below.
For Windows : C:\Program Files\3CX Phone System\Bin\3CXPhoneSystem.ini
For Linux: /var/lib/3cxpbx/Bin/3CXPhoneSystem.ini
* From this file look for the stanza name
DbAdminREADONLY. Fetch the password from the stanza and fill it in the password field of Identity Wizard.
After Creating Identity Create DB Connections with 3CX PostgresQL.
In Splunk DB Connect, click the Configuration > Databases > Connections tab.
Click New Connection.
On the New Connection page, complete the following fields:
* Connection Name: 3CX
* Identity: Choose the identity 3CX Created in first step.
* Connection Type: Postgress
* Timezone: Select Timezone if required.
* Click on Save.
defaultdirectory of this App, copy the
db_inputs.conf.templatefile to $SPLUNK_HOME/etc/apps/splunk_app_db_connect/local/db_inputs.conf
defaultstanza replace the host value with the hostname you want to add for your forwarder.
Macro definition change is required to improve the dashboard performance. Follow below steps to change the macro definition.
Settings > Advanced search > Search macros.
Splunk App for 3CX.
default_index and click on it.
Change value in the definition section from
custom-index is the index which you have selected in
Data Collection section while creating DB Connect inputs.
* Final value should look something like:
To uninstall app, user can follow below steps:
SSH to the Splunk instance
Go to folder apps($SPLUNK_HOME/etc/apps)
Remove the checkpoint_dome9_app_for_splunk folder from apps directory
* Created App with two dashboards, Insights and Alerts.
Data Collectionguide from
CONFIGURATIONsection to make sure Database collection is all good.
Verify the data via searching the data with
Dashboards are not populating
Data collection issueor else go through second point.
Make sure the index is specified in the
default_index macro. Check
Macro Definition Change guide from
CONFIGURATION section for more details.
Dashboards are not working as expected.
The app delivers insights on Alerts and information related to calls on the dashboards.
Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.