I need to view the hits on an access list I have running on a clients layer 3 switches and routers. I know the syslog messages for the ACL are making it to the MARS. What event type do I need to select and query type do I need to select to get a report on this information?
You can do a query with the result type "Unknown Event Types" to list all the logs with Unknown Reporting Devices. It will show an "Add Device" button wherever applicable which displays the result set.