All Apps and Add-ons

Cisco ISE host versus NetworkDeviceName

Communicator

Hi Team,

Just wanted to check with you what is the difference between host and NetworkDeviceName in Cisco ISE context?

I had use the SPL queries below and have different results.
index=cisco_ise | stats count by host

index=cisco_ise | stats count by NetworkDeviceName

A little background on Architecture, we have Syslog servers (Splunk Forwarders as well) where cisco ise traffic logs are written, then we use Splunk file monitoring to check those cisco ise traffic logs and ingest it to Splunk. We also have Splunk Add-on for Cisco ISE installed on those Syslog servers/Splunk Forwarders. Then we have that Splunk Add-on for Cisco ISE also on our Indexer Tier and Search Tier for field extraction and other conf. On our Search Head, we have the SplunkApp for Cisco ISE.

Regards,
Jaracan

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!