icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Cisco CDR Reporting and Analytics
SHA256 checksum (cisco-cdr-reporting-and-analytics_539.tgz) 0466668f231945ce3f417a9454f10c7d9974cacffff1ca9d81dbd1f7f4e51f12 SHA256 checksum (cisco-cdr-reporting-and-analytics_538.tgz) 517d32f9b2eec0e00026f91a6252615f4f2a2d759e4c985e49f08f1a5412e7de SHA256 checksum (cisco-cdr-reporting-and-analytics_537.tgz) f169a247a1aac8cffc5c060e8a3891160775746409e21fe92a87ccc8e73f97fa SHA256 checksum (cisco-cdr-reporting-and-analytics_536.tgz) c69bb60eb7de33f89854e7abfdf2fc1f5789def5b7515923d22e8efd432693f8 SHA256 checksum (cisco-cdr-reporting-and-analytics_535.tgz) 1ad003a2ea29aeb5c9bf35ef43d47e5f6652c5b1194c8447f7f03cb69a5b2a2f SHA256 checksum (cisco-cdr-reporting-and-analytics_534.tgz) 69ed38f5681fd1519461f0b46a691d28fef034b3a912d55c91c93d72640821d6 SHA256 checksum (cisco-cdr-reporting-and-analytics_533.tgz) 174cb3a99a19336e0916007a6d90008ad5399c9b30e1a4e47fa40fc6fdcc592e SHA256 checksum (cisco-cdr-reporting-and-analytics_532.tgz) 6d03ef58a2f9dbd539553a597312bc734c2bc771c52bb58a97b1524d153eb8ef SHA256 checksum (cisco-cdr-reporting-and-analytics_531.tgz) 28ef02eb9227410955eeb3c58791904800a7c15a4aeb5164a25d8ec89e74e56c SHA256 checksum (cisco-cdr-reporting-and-analytics_53.tgz) 35130ea93e9cf38ac39a01bbe00f58d4f0024652371dc4fc0336b141e2899512 SHA256 checksum (cisco-cdr-reporting-and-analytics_527.tgz) 93debc332cfa8070d96ffa543aa7bc3313456b5298bc82782f26d8c054d40f68 SHA256 checksum (cisco-cdr-reporting-and-analytics_526.tgz) 12e915752913a6b682ac55811f0b7b0aedc0c700f12ec69edd1cc1e0f528bd34 SHA256 checksum (cisco-cdr-reporting-and-analytics_525.tgz) 1b4ed2cc6f761215c75555c028534e9c4edbbafc3f1e53673c46fe2827fb8a49 SHA256 checksum (cisco-cdr-reporting-and-analytics_524.tgz) 1867c0ff4f7d53562f856ef701af9b6c2c8f82af895e6adb82a9b81928347036 SHA256 checksum (cisco-cdr-reporting-and-analytics_523.tgz) 29757b59952e332b3758d79d4a3d7a9671858a895c135b00f093c6db7a70ea03 SHA256 checksum (cisco-cdr-reporting-and-analytics_522.tgz) 9627db39920b2387db11a673a375b242b1f908e3e04a9f15d3307d00006fcc0d SHA256 checksum (cisco-cdr-reporting-and-analytics_521.tgz) e40035da2aaf3bfc32b620c8d025d5532c59b508ed6716ceaa4c3ec778ad086f SHA256 checksum (cisco-cdr-reporting-and-analytics_52.tgz) e93db9b2dc87701f4e3463b15fe96ec03387c05b9ccfa6930edbf7ca1e191613 SHA256 checksum (cisco-cdr-reporting-and-analytics_515.tgz) d8f1a49ccd0f8c5aa92e53f02a0ce14da2726f3def8e412c139424bcb704a00c SHA256 checksum (cisco-cdr-reporting-and-analytics_514.tgz) 096870b2b04722e623a6f808be1e042736fc48477024458cd0ca7874961c449b SHA256 checksum (cisco-cdr-reporting-and-analytics_513.tgz) d589612aac35c468c5f99313fadf56b562234563a17b33e34221073ea9c884bc SHA256 checksum (cisco-cdr-reporting-and-analytics_512.tgz) 3ad88a17e2e686ecc0959fea4f85072e4358a80383746e2452f8e8a30b5a97b4 SHA256 checksum (cisco-cdr-reporting-and-analytics_511.tgz) 0ce5aa71a59c9f516d43fc43d3e8f58db2a8e423e75a542a6c112ef7ee53664d SHA256 checksum (cisco-cdr-reporting-and-analytics_51.tgz) 9ea5e5c58227b8015b8ec0bb0c44dae9549a5d6912e28c5f122100cf496af393 SHA256 checksum (cisco-cdr-reporting-and-analytics_5010.tgz) fc7595eaf785b1afda62485606b3916febb62c35e76ec41dcc370530b4ae2f49 SHA256 checksum (cisco-cdr-reporting-and-analytics_509.tgz) 25f7b0c997b6b007cdf46d11422ffb546bf46ff9b7fe5dd4b92ce20b0e3989b3 SHA256 checksum (cisco-cdr-reporting-and-analytics_508.tgz) cc662bca12848c478963af44c10a58cc063a3b30c064eb2311315b9c655de84d SHA256 checksum (cisco-cdr-reporting-and-analytics_507.tgz) b10e95120b54c2c58aa58894ac83589f8b41a5a9cc450af9c30285f5c21e57ec SHA256 checksum (cisco-cdr-reporting-and-analytics_506.tgz) 164dd1723cf4a1d7a2be1a1f20c481a15dc658f36be6598ea081423d52eb0285 SHA256 checksum (cisco-cdr-reporting-and-analytics_504.tgz) 810fcf66c0468b40205bcca59051ee3c0e005a3e6208fa985da2c570219e801c
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate

Cisco CDR Reporting and Analytics

Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
This commercial app provides visibility, monitoring and reporting functionality for Cisco CallManager, whether you're a small organization with just a hundred phones or one of the largest companies in the world. It is available as a free 90 day trial and you can download and set it up today in less than 30 minutes. Your team can use it and trust it as their day-to-day tool navigating the call data from your Cisco CallManager deployment but it can also become their main tool to build any custom reports, alerts and dashboards around that data. This is true whether it’s a standard report you expect or a custom report that nothing else has been able to provide.

Note that this isn't a package of content, but more a tank that you drive around in your data. You wont find a leftnav full of canned reports to click on (that "don't quite fit"). Instead you get an open flexible framework to investigate anything, drill down into anything, report on anything, over anything, by anything. (occasionally with hands-on help from Sideview Support. =)

Your team can have better day-to-day call flow visibility AND flexible reporting for CallManager.

  • Quickly see all calls matching any search filters.
  • Drilldown at any time to thoroughly investigate a particular call.
  • Click your way to pretty much any report over any combination of fields.

That third bullet sounds a little crazy - what about some examples?

You can:

  • create reports around concurrent calls and dropped calls.
  • create a chart of usage stats about your hunt groups.
  • see and share inbound/outbound call stats by agent or department.
  • create custom call quality reports and dashboards (MOS, jitter, latency, packet loss).
  • build utilization reports by device, device_type, sites, buildings, you name it.
  • drilldown at any time from any report, to inspect and sanity check the calls themselves.
  • but really, pretty much anything. Try it and see.

What are these, reports? dashboards? alerts?

Yes. For any of those use cases (and any you can dream up), you can:

  • create graphs, charts, tables, and even mapping visualizations of various kinds and package them into dashboards if you like.
  • set up alerting around anything - dropped calls, quality, volume thresholds.
  • share any and all of the above as dashboards with different teams and colleagues.
  • automate dashboards you created, to send pdf’s of themselves out every day/week.

What about my report that I don't see listed here?

Contact us and we'll help you learn how to create what you need for your own “somewhat unusual” CallManager deployment. There are over 200 fields (Check them out here). If you can in principle calculate the thing you need from some number of those fields, in some product or by hand, then we can show how to make the app do it.

Can I try it out?

Yes you can download the app from Splunkbase or from this site, and you can get a 90 day trial license string from this site. You can set the whole thing up yourself with your own live data, in about 30 minutes. See our installation and setup docs here.


The app is priced by the size of your CallManager deployment - specifically the total number of User Licenses and Unassigned Device Licenses that are in use, in CallManager itself. At and below 400 such licenses in use, the cost is only $1,200 per year, but we have a range of customers at all scales from below 100 to above 50,000 licenses in use. Send us a screenshot of the total licenses in use from PLM, or a screenshot per cluster of the "License Usage Report" in CM Admin and we can let you know the exact cost.

Splunk Enterprise - do I need it?

Yes. The majority of our prospects are already Splunk Enterprise customers, and if this is you, this app will likely add only a negligible additional load to ingest the CallManager data that it needs. If you're not, Sideview is also a Splunk Reseller in North America so we can help you on that side.

How about Splunk Cloud?

Yes the app is vetted for Splunk Cloud. We do recommend that you contact us before proceeding though.

What versions of CUCM are supported?

CUCM 7.0 up to the current release 12.X

What are the actual data sources that it uses?

However if the data you're hoping to work with isn't in that list, Feel free to contact us anyway!.

Release Notes

Version 5.3.9
Jan. 15, 2021

Unfortunately Splunkbase truncates release notes at 1024 characters and our notes for this release are longer than that.

To read the full release notes visit our site at: https://sideviewapps.com/apps/cisco-cdr-reporting-and-analytics/release-notes/

Version 5.3.8
Dec. 2, 2020

- Patched a bug that only occurs in Splunk 8.1, where some of the SPL used by the "call concurrency and gateway utilization" page does something the 8.1 SPL parser doesn't like.
- Changed how the app's homepage checks for indexed data. Formerly it used the metadata command, but since this command can be deliberately disabled for lower privilege users, that can in turn cause the check to fail erroneously. The end result was some lower-privilege users would only see a homepage telling them that they hadn't indexed any data yet. This is fixed now and the check uses a tstats search.
- Fixed a typo in our health check responsible for finding unusual indexing lag, that had been preventing it from running properly.
- Fixed a minor problem where if someone was trying out the app while running only a Splunk Free license in Splunk itself, our health checks for user/role capabilities would fail erroneously.

Version 5.3.7
Nov. 6, 2020

- Fixed a bug around the ROOT_ENDPOINT key, where users could get redirected to malformed URLs that were missing a slash between the root endpoint and the locale.
- Improved the health check for indexing lag to list the 95th percentile of the lag in the health check message directly.

Version 5.3.6
Oct. 29, 2020

Fixed a critical regression introduced in 5.3.5 that broke the app on 7.X versions of Splunk.

Version 5.3.5
Oct. 16, 2020

Fixed a problem where the app's own license checks would fail if the Splunk server was using the "root_endpoint" key. This would result in the license check failing when Splunk was set up in a reverse proxy configuration.

Version 5.3.4
Oct. 7, 2020

- Fixed a bug on the Call Detail page where the panel displaying fields from individual call legs only let you choose selected fields from a subset of the available fields</li>
- Browse Extensions now allows you to pick a particular subset of your UCM Clusters, in addition to filtering by group/subgroup/name/number/huntGroup etc.</li>
- Minor changes to our default device_type extractions to catch some unusual cases in the field for instance where jabber device names occasionally have hyphens or other non-alphanumeric characters in them.</li>
- Call Detail page now has 'see search syntax' links allowing you to see and troubleshoot aspects of the raw CDR events or CMR events in the default Splunk UI</li>
- Minor modifications to some of our health checks to reduce false positives.</li>
- App now ships an app.manifest file which may help various things stay on the tracks in Splunk Cloud

Version 5.3.3
Aug. 26, 2020

Resolved a longstanding bug where the devices lookup would be unexpectedly empty after an install or update.
-- The Cisco CDR app's navigation has been subtly reworked to improve user experience if folks
miss the step about installing the Canary app, and also to allow us to soon remove the
dependency on Sideview Utils for users on Splunk 8 and up.
-- Several existing health check searches improved to be more robust.
-- Additional health check search created to find duplicated data.
-- Browse Devices page now has a "see raw search syntax" link.
-- Browse Devices page now has an optional field called "last_seen" listing the date and time of when the device was last involved in any call.
-- Added destAudioCodec and origAudioCodec, which will have values like "G711mu-law 64k" or "G729".

Version 5.3.2
June 25, 2020

- Hoopjumping for some less-than-ideal problems in the Splunk Cloud vetting process. This release deletes one line of python code that was already commented out. This line was causing the app to silently fail Cloud-Vetting for several months, for an erroneous and silly reason. Also compounding the problem greatly is that Splunk's vetting process gives zero feedback or messaging to the third party app developer such that we were unable to even learn about the existence of this failure until recently. We had assumed that Cloud was really bogged down with vetting again. Thanks to the internal resource who dug into the matter and was able to tell us the details.

Our apologies to all our customers and prospects who over the past few months were told erroneously that the recent releases of this app were not cloud compatible. Also thanks to the internal splunkers who are trying to fix these problems and improve these broken processes.

Version 5.3.1
June 3, 2020

Unfortunately Splunkbase still truncates release notes at 1000 characters, which is quite a lot shorter than the notes for this release.

Luckily you can read our full release notes for this and other releases on our website here -


Version 5.3
April 25, 2020

Unfortunately Splunkbase still truncates release notes at 1000 characters, which is quite a lot shorter than the notes for this release.

Luckily you can read our full release notes for this and other releases on our website here -


Version 5.2.7
March 26, 2020

- Fixed a bug in the Call Concurrency page where the drilldown on the main chart (to display a more fine grained concurrency chart within that one data point), failed with an error
- Fixed a bug in the Call Concurrency page where the gateways pulldown would in some situations load only a partial list of your gateways
- Fixed a bug in the Call Concurrency and Gateway Utilization page where if you had a subset of your gateways selected, and "no split by" selected, the chart would not render.
- Fixed a bug when loading the Extension Detail page in the Canary UI, where the top panel would load blank and collapsed. The layout of the information in the top panel has also been improved somewhat

Version 5.2.6
March 20, 2020

- Fixed a bug where the Cisco CDR app wouldn’t accept new licenses for the app if the Splunk Enterprise instance was only running the Splunk Free License.
- Fixed a regression on the Gateway Utilization page. Essentially the fix in 5.2.4 for the “unwanted types showing up” bug had a flaw in it, that not only didn’t work but regressed the same behavior for the gateway side. There is now unit testing covering this to try and make sure it never happens again.

Version 5.2.5
March 12, 2020

- Fixed a regression in the 'set up data inputs' wizard that only affected 8.X.
(Note this functionality is only relevant to users who have a standalone splunk
instance on one host, with not even any forwarders involved.)
- Improved UI messaging for the 'set up data inputs' wizard so that if the user
is not an admin user or they are, but they lack the admin-all-objects capability,
they get an error telling them as much instead of a confusing "AuthorizationFailed"
error message.
- Switched over to using the new restmap.conf controller for the "upload csv" functionality
for both Setup Groups and Setup Sites.
- Some cleanup in our python logging.

Version 5.2.4
Feb. 29, 2020

Unfortunately Splunkbase still truncates release notes to only 1000 characters. To read the full release notes for 5.2.1 visit the release notes page on our website.


Version 5.2.3
Jan. 9, 2020

-- Fixed a typo in the concurrency searches if you did not have a split-by
field set. Improved test coverage to avoid regressions in this area in
the future.
-- Updated python to include latest version of libphonenumbers
-- Updated the "npa-nxx-lata-clli-ocn-location" lookup. This is the piece
that allows the app to take a north american number with just areacode
and exchange, and create fields with city, state, zip, CLLI, OCN,
CompanyType, latitude and longitude.

Version 5.2.2
Jan. 2, 2020

-- Fixed some critical problems that were introduced with 5.2.1's new field
extractions for gateway, device_type and type fields. Chief among these was
a problem where FXO ports on MGCP gateways were getting misunderstood by
5.2.1 as calls to internal devices rather than outgoing calls.
-- Fixed a bug in the Call Concurrency and Gateway Utilization page that only
affected tandem calls, where the concurrency numbers for those gateways
would be undercounted.
-- Fixed an obscure bug where if you attempted to use one of the dateTime*
field as a search term, and you used it with a comparison operator like ">",
on multi-leg calls, the filtering would not work.
-- Fix made to our first-time-run and migration script to make it not error
out when run in python3 on splunk 8.

Version 5.2.1
Dec. 11, 2019

Unfortunately Splunkbase still truncates release notes to only 1000 characters. To read the full release notes for 5.2.1 visit the release notes page on our website.


Version 5.2
Nov. 5, 2019

Splunkbase still truncates release-notes to 1024 characters so unfortunately to read the release notes you have to go to the following URL:


Version 5.1.5
Oct. 7, 2019

Splunkbase truncated release-notes to 1024 characters so unfortunately until that is fixed you have to go to the following URL to read the full release notes:


Version 5.1.4
Sept. 23, 2019

Splunkbase truncated release-notes to 1024 characters so unfortunately until that is fixed you have to go to the following URL to read the full release notes:


Version 5.1.3
Aug. 27, 2019

Version 5.1.3 (August 26th, 2019)
> Converted the encoding of a number of static file-based lookups from ascii
to UTF-8 to allow customers to more easily translate the english language
content there into a local language.
> Added a key to server.conf so that when admins update the sideview license
on any Clustered Search Head, that license change will be propagated to the
other SHC members.
> Improvements to the app_setup/migration script so that it better handles
unexpected cases where the clusters/devices/groups/cidr lookups on disk
are found to be empty. It will now detect this case and attempt to replace
the contents of the file with the corresponding *.default.csv file.


Version 5.1.2
July 21, 2019

Version 5.1.2 (July, 2019)
> Fixed a bug where when using max(concurrency) in the General Report view,
your "bins" setting would be ignored and a default bins ceiling of 400
would get used instead.
> Fixed a bug in Browse Extensions, and Browse Devices, where if you entered
values into a text field and then without changing anything else clicked
the submit button instead of hitting the enter key, the values you entered
would be ignored.

Version 5.1.1
July 12, 2019

Version 5.1.1 (July 11th, 2019)
> Made a change so that if the Splunk instance is a Search Head Cluster and
someone tries to post a new license string into the Update License page,
it takes no action and gives them a helpful error.
> Snuck in a semi-secret feature whereby concurrency reports can be done in a
limited fashion within General Report and Browse Calls.
> Updated the "npa-nxx-lata-clli-ocn-location" lookup.
> Updated python to include latest version of libphonenumbers

Version 5.1
June 10, 2019

Version 5.1 (June 2019)
> Major improvements to both functionality and usability of the Browse
Devices page.
> Devices lookup now can hold an additional column "productName". When
present this creates fields origProductName and destProductName.
> Device Detail page now has an additional tab that displays additional
summary details like unicodeLoginUserId values and numbers associated with
the device, as well as any values that our SA_cisco_cdr_axl app may have
pulled from CallManager via AXL.

Version 5.0.10
May 16, 2019

Version 5.0.10 (May 14th, 2019)
> Removed the CSR and SCSR field from the field gallery because we realized
that these fields don't actually exist in the CMR itself yet.
> Added CS_total and SCS_total as new fields on the calls, which are the
total seconds of concealed speech and the total seconds of severely
concealed speech, across ALL CMR associated with the given call.
> Added CSR_overall and SCSR_overall fields, which are respectively the
CS_total/duration_total, and SCS_total/duration_total.
As such these represent reliable concealed speech ratio metrics for any
devices reporting CS and SCS.
> Fixing a bug in the transfers and legs fields, where if you used them
as a split-by field in reporting, they would get very significantly
overcounted, as represented by the range numbers in the legend for the
split by values.
> Call Detail view now displays the time of any CMR that are present, either
by listing the value of its dateTimeStamp field or failing that, presenting
the ti

Version 5.0.9
April 12, 2019

Version 5.0.9 (April 12th, 2019)
> Improved error messaging when underprivileged users attempt to update
the app's license string, and when invalid licenses are submitted.
> Removed the embedded app TA_cisco_cdr, as this has now been released
separately on Splunkbase. NOTE - versions posted on Splunkbase did not
have have the TA's in them so this only reflects a change for users
downloading from the Sideview website.
> Fixed a bug where orig_device_type, dest_device_type and device_type
fields would not populate correctly for non-mgcp gateway devices.
> Implemented a small improvement for the device_type field on individual
call legs. If both types are the same, the field now only holds the single
distinct value
> Implemented a subtle fix to what the app calls its "union fields", (group,
name, subgroup, ip_addr and device_type) so that in the aggregated call
results, these fields now only list the distinct values.
> Improved the Groups lookup's handling of wildcarded numbers by havi

Version 5.0.8
March 13, 2019

Version 5.0.8 (March 12th, 2019)
> Improved the "to" and "from" fields so that if one of the geographical
fields like city OR state is blank, it does not fall all the way back to
displaying only country (this can happen with wireless numbers where there
is no city associated)
> Raising the minimum version asserted by the app, from Splunk Enterprise 6.2
to Splunk Enterprise 6.4, as our new license endpoint was found to be only
compatible with 6.4 and up.
> Fixed a bug when adding a dashboard panel to a shared dashboard not owned
by the current user. Previously this would fail with a confusing 404 error.
> Fixed a bug when creating a new dashboard entirely, where the dashboard
panel creation would fail with "ERROR 400 Cannot create an object with
empty or all whitespace name"
> When saving a new report, sharing the report with others now works properly.
> When creating a new dashboard for new dashboard panels, the UI now prompts
you if your desired dashboard name contains invalid charact

Version 5.0.7
March 1, 2019

Version 5.0.7 (March 1st, 2019)
> Fixed a critical bug for Cloud users and users downloading from Splunkbase
that effectively barred all non-admin users from the product.
> Health checks page can now be run even when product lacks a valid license.
> Filtered out unnecessary "Successfully loaded lookup file" UI messages.
> Added a warning to users who attempt to enter raw numeric terms into the
'search filters' field, as this is not supported and will return 0 results.

Version 5.0.6
Feb. 27, 2019

Version 5.0.6 (February 27th, 2019)
> Fixed a common problem where license strings pasted into "Update License"
would fail if they had an extra leading or trailing space character.
> Improved the fix done in 5.0.5 around the "Sideview Utils not installed"
error case to no longer require a custom module.

Version 5.0.4
Feb. 5, 2019

Version 5.0.4 (February 4th, 2019)
> Fixed a bug where if you were using * as a wildcard in your groups lookup
entries the Extension Detail page for matching numbers would fail to list
the name, group, subgroup information.
> Migration check added, to look for old saved reports that have ui_edit_view
specified but no ui_context. Since these will be unable to reload themselves
in the specified view they are now migrated to load in the default splunk
'report' view.
> the Setup Groups page now gives users the ability to download a copy of the
groups lookup as a csv or to open it directly in Excel.
> Fixed a bug around the "save report" buttons - the resulting reports would
reload fine in the Sideview UI but the underlying savedsearch stanza had an
extra "search" prepended to the SPL that would make it always return 0
results when run from core splunk interfaces and from the scheduler.


Subscribe Share

AppInspect Tooling

Splunk AppInspect evaluates Splunk apps against a set of Splunk-defined criteria to assess the validity and security of an app package and components.

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps and add-ons from Splunk, our partners and our community. Find an app or add-on for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
© 2005-2021 Splunk Inc. All rights reserved.
Splunk®, Splunk>®, Listen to Your Data®, The Engine for Machine Data®, Hunk®, Splunk Cloud™, Splunk Light™, SPL™ and Splunk MINT™ are trademarks and registered trademarks of Splunk Inc. in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners.