Hi Team,
Just wanted to check with you what is the difference between host and NetworkDeviceName in Cisco ISE context?
I had use the SPL queries below and have different results.
index=cisco_ise | stats count by host
index=cisco_ise | stats count by NetworkDeviceName
A little background on Architecture, we have Syslog servers (Splunk Forwarders as well) where cisco ise traffic logs are written, then we use Splunk file monitoring to check those cisco ise traffic logs and ingest it to Splunk. We also have Splunk Add-on for Cisco ISE installed on those Syslog servers/Splunk Forwarders. Then we have that Splunk Add-on for Cisco ISE also on our Indexer Tier and Search Tier for field extraction and other conf. On our Search Head, we have the SplunkApp for Cisco ISE.
Regards,
Jaracan
