IT Operations AnalyticsVoIP Analysis in Splunk

Corvil Enables VoIP Performance Reporting and Analysis in Splunk

Corvil VoIP App for Splunk

Corvil’s collaboration with Splunk delivers VoIP operational intelligence and streamlines troubleshooting workflows to assure and improve your users’ experience of VoIP Services.

Corvil’s ability to discover and analyze the status and performance of every minute of every call is published within Splunk in real-time to accelerate your time to insight. The app also visualizes the full lifecycle of any call to simplify troubleshooting so VoIP operations teams can be more efficient.

VoIP App for Splunk Solution Demo



  • Leverage user’s familiarity of Splunk’s data visualization and investigation capabilities to enable the management of VoIP performance
  • Reduce MTTR by reporting on all failed calls in Splunk with one click to a ladder diagram visualization of the complete lifecycle of the call to pinpoint the cause of failure
  • Trust the root cause of call failures reported in Splunk - the data is based on packet data published by Corvil rather than software logs
  • Proactive notification in a Splunk dashboard of a surge in call failure rates or poor call quality issues
  • One click access from Splunk to export either the signaling or RTP packets captured by Corvil for examination in a third party tool

"By 2019, end-user VoIP and UC monitoring will be prerequisites for 60% of mainstream network performance monitoring and diagnostics (NPMD) tool procurement, up from 20% in 2015."

Problem Overview

VoIP issues are highly visible and can have serious consequences on day to day business operations. IT operations teams relying on Splunk to correlate infrastructure health and availability metrics are realizing that they need more to efficiently troubleshoot problems. The existing health metrics cannot provide:

  • Call-centric reporting of user experience
  • Visualizations that simplify root-cause identification
  • Clickable options to get call-specific packet data and captures

Without these capabilities within their familiar Splunk environment, these teams will continue to spend weeks manually investigating intermittent voice quality issues while user frustration rises.


  • Budgets can not justify a standalone tool for VoIP. VoIP is a critical service, but so are all other business applications.
  • Scraping session manager and session border logs do not provide a definitive, trustworthy record of call failures.
  • Legacy VoIP performance monitoring vendors do not publish the data required for Splunk to provide VoIP troubleshooting.
  • Troubleshooting complex VoIP problems requires easy access to packet captures from multiple network segments.
  • Tools provided by the VoIP infrastructure vendors do not measure actual call quality and can’t troubleshoot call quality issues.

The tools' ability to be integrated with other third-party tools and the ability of those third-party tools to integrate with NPMD tools are increasingly important factors, particularly for organizations that license best-of-breed ITOM products, as opposed to products from a single vendor.

Solution Overview

The Corvil VoIP App for Splunk is available on Splunkbase. This provides visualizations and analysis of call volumes, failed calls, signaling errors and poor quality calls. This analysis is driven from the Corvil platform which provides real-time discovery, decoding, analysis and publishing from the packet data on the network into Splunk for analysis by the Corvil VoIP App. A dashboard in Splunk reports VoIP call volume trends, failed calls, signaling errors and all poor quality calls. This dashboard is based on Corvil’s support for a breadth of protocols including H.323 (and proprietary variants), SIP, RTP, RTCP and SCCP.

Corvil passively taps into the packet data flowing in the network which contains a highly granular and accurate record of the VoIP activity. The Corvil solution uniquely mines this packet data by automatically discovering all VoIP calls, tracking the lifecycle of the call and reporting a number of key performance metrics.


  • Click on a failed call reported in the dashboard for a ladder diagram visualization of the full lifecycle of the call across multiple session managers and SBC’s to pinpoint the root cause of failure.
  • One click from the ladder diagram to download both VoIP signaling and media traffic in a pcap file to further diagnose issues in a third party tool.
  • Historical search on a CallID, Called Number, Caller number, user name etc. to identify to troubleshoot user complaints.
  • Quickly identify a surge in failed calls, poor quality calls or even call volumes to enable proactive resolution of VoIP infrastructure issues.
VoIP Analysis in Splunk


  • The full lifecycle of the call is visualized in a ladder diagram
  • Calls are tracked across gateways, SBC’s and session managers
  • Click on any message in the call to see a full decode of the message contents
  • Quickly pinpoint where the call has failed


  • Highlights all failed calls and poor quality calls
  • Reports call signalling errors
  • Historical search and analysis on any CallID, number, user name, etc.
  • Report on call volumes, maximum concurrent calls and trends

Ease of Use

  • From Splunk, one click to Corvil export of the signalling packets and/or the media packets for the call
  • Exported as standard pcap file for analysis in third party tools including VoIP replay

VoIP Analysis in Splunk

Voice Quality Metrics

RTP MOS, Jitter and loss based on measuring 100% of network packets for every VoIP call.

Failed VoIP Calls

Report on call setup times and signaling errors for the full breadth of VoIP protocols including some vendor variants.

Ladder Diagram Visualization

Visualize the full lifecycle of the call across multiple hops to pinpoint root cause of call failures.

Quality Analysis by Codec

Report MOS scores per discovered Codec active in the network.

Call Trends

Discover and report the call volume activity trends including calls per gateway/SBC, calls per session manager and maximum concurrent active calls

Signalling and Media Packet Export

Search, visualize call lifecycle and then click to export a pcap file of the signaling and media traffic for the call.

Single Click to Packet Visualization

Click on a call and navigate to Corvil's packet analysis including jitter, loss and mis-marked RTP packets

Service Provider Performance

Corvil measures the point to point latency, loss and jitter for every RTP media packet as they traverse your service provider WAN links.