IT Operations AnalyticsVoIP Analysis in Splunk

Corvil Enables VoIP Performance Reporting and Analysis in Splunk

Corvil’s collaboration with Splunk delivers VoIP operational intelligence and streamlines troubleshooting workflows to assure and improve your users’ experience of VoIP Services.

Corvil’s ability to discover and analyze the status and performance of every minute of every call is published within Splunk in real-time to accelerate your time to insight. The app also visualizes the full lifecycle of any call to simplify troubleshooting so VoIP operations teams can be more efficient.

VoIP App for Splunk Solution Demo



  • Leverage user’s familiarity of Splunk’s data visualization and investigation capabilities to enable the management of VoIP performance
  • Reduce MTTR by reporting on all failed calls in Splunk with one click to a ladder diagram visualization of the complete lifecycle of the call to pinpoint the cause of failure
  • Trust the root cause of call failures reported in Splunk - the data is based on packet data published by Corvil rather than software logs
  • Proactive notification in a Splunk dashboard of a surge in call failure rates or poor call quality issues
  • One click access from Splunk to export either the signaling or RTP packets captured by Corvil for examination in a third party tool

Ranked #1 for Network Analysis that Integrates Intelligently With Your Ecosystem

Info-Tech Research Group

Read the Report

"By 2019, end-user VoIP and UC monitoring will be prerequisites for 60% of mainstream network performance monitoring and diagnostics (NPMD) tool procurement, up from 20% in 2015."


Problem Overview

IT Operations Teams re Realizing That They Need More to Efficiently Troubleshoot Problems

VoIP issues are highly visible and can have serious consequences on day to day business operations. IT operations teams relying on Splunk to correlate infrastructure health and availability metrics are realizing that they need more to efficiently troubleshoot problems. The existing health metrics cannot provide:

  • Call-centric reporting of user experience
  • Visualizations that simplify root-cause identification
  • Clickable options to get call-specific packet data and captures

Without these capabilities within their familiar Splunk environment, these teams will continue to spend weeks manually investigating intermittent voice quality issues while user frustration rises.


  • Budgets can not justify a standalone tool for VoIP. VoIP is a critical service, but so are all other business applications.
  • Scraping session manager and session border logs do not provide a definitive, trustworthy record of call failures.
  • Legacy VoIP performance monitoring vendors do not publish the data required for Splunk to provide VoIP troubleshooting.
  • Troubleshooting complex VoIP problems requires easy access to packet captures from multiple network segments.
  • Tools provided by the VoIP infrastructure vendors do not measure actual call quality and can’t troubleshoot call quality issues.

Call Quality Issues are Highly Visible and Have Serious Business Consequences Download our eBook

Solution Overview

Real-Time Discovery, Decoding, Analysis and Publishing from Packet Data on the Network Into Splunk

The Corvil VoIP App for Splunk is available on Splunkbase. This provides visualizations and analysis of call volumes, failed calls, signaling errors and poor quality calls. This analysis is driven from the Corvil platform which provides real-time discovery, decoding, analysis and publishing from the packet data on the network into Splunk for analysis by the Corvil VoIP App. A dashboard in Splunk reports VoIP call volume trends, failed calls, signaling errors and all poor quality calls. This dashboard is based on Corvil’s support for a breadth of protocols including H.323 (and proprietary variants), SIP, RTP, RTCP and SCCP.

Corvil passively taps into the packet data flowing in the network which contains a highly granular and accurate record of the VoIP activity. The Corvil solution uniquely mines this packet data by automatically discovering all VoIP calls, tracking the lifecycle of the call and reporting a number of key performance metrics.


  • Click on a failed call reported in the dashboard for a ladder diagram visualization of the full lifecycle of the call across multiple session managers and SBC’s to pinpoint the root cause of failure.
  • One click from the ladder diagram to download both VoIP signaling and media traffic in a pcap file to further diagnose issues in a third party tool.
  • Historical search on a CallID, Called Number, Caller number, user name etc. to identify to troubleshoot user complaints.
  • Quickly identify a surge in failed calls, poor quality calls or even call volumes to enable proactive resolution of VoIP infrastructure issues.

"The tools' ability to be integrated with other third-party tools and the ability of those third-party tools to integrate with NPMD tools are increasingly important factors, particularly for organizations that license best-of-breed ITOM products, as opposed to products from a single vendor."



  • The full lifecycle of the call is visualized in a ladder diagram
  • Calls are tracked across gateways, SBC’s and session managers
  • Click on any message in the call to see a full decode of the message contents
  • Quickly pinpoint where the call has failed


  • Highlights all failed calls and poor quality calls
  • Reports call signalling errors
  • Historical search and analysis on any CallID, number, user name, etc.
  • Report on call volumes, maximum concurrent calls and trends

Ease of Use

  • From Splunk, one click to Corvil export of the signalling packets and/or the media packets for the call
  • Exported as standard pcap file for analysis in third party tools including VoIP replay

VoIP Analysis in Splunk


RTP MOS, Jitter and loss based on measuring 100% of network packets for every VoIP call.


Report on call setup times and signaling errors for the full breadth of VoIP protocols including some vendor variants.


Visualize the full lifecycle of the call across multiple hops to pinpoint root cause of call failures.


Report MOS scores per discovered Codec active in the network.


Discover and report the call volume activity trends including calls per gateway/SBC, calls per session manager and maximum concurrent active calls.


Search, visualize call lifecycle and then click to export a pcap file of the signaling and media traffic for the call.


Click on a call and navigate to Corvil's packet analysis including jitter, loss and mis-marked RTP packets.


Corvil measures the point to point latency, loss and jitter for every RTP media packet as they traverse your service provider WAN links.