cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

988
Views
5
Helpful
1
Replies
Highlighted
Beginner

Reporting based on AV called-station-id

Running ISE 2.4, i am unable to create a report that includes the called-station-id field

It is not in the columns available for reporting.

Is there a way to report on this AV pair?

Can AV pairs from auth logs be exported via syslog?


Much appreciated

-Eric M

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

You are correct that the called-station-ID only available in authentication detailed reports, which are not available for export.

Yes, an external syslog target is an option to obtain this info. Configure Cisco ISE to send logs to Splunk Enterprise for the Splunk Add-on for Cisco ISE might of interest to you.

View solution in original post

1 REPLY 1
Highlighted
Cisco Employee

You are correct that the called-station-ID only available in authentication detailed reports, which are not available for export.

Yes, an external syslog target is an option to obtain this info. Configure Cisco ISE to send logs to Splunk Enterprise for the Splunk Add-on for Cisco ISE might of interest to you.

View solution in original post