We have recently installed the Cisco ISE Add-ON (APP-1915). It appears to be working okay for the most part except for when I try to search the Failed Authentications for a Specific Location tab. I'm not getting any results, however, I do when I look at the summary page. Are there any modification I need to make to get that information?
I took a look at the page at this is the code snippet I believe is attempting to pull the data. Can anyone confirm this would provide "failed authentications by locations"? I want to be able to click on the dropdown box a pick a specific location instead of seeing the entire pie chart that I see on the summary page within the Splunk App.
eventtype=cisco-ise-failed-authentication Location="$location$" NAS_Port_Type="Wireless - IEEE 802.11" |
chart count by AuthenticationMethod |
rename AuthenticationMethod AS "Authentication Method"