Create a report on access lists from a switch or router

[deyster94]

I need to view the hits on an access list I have running on a clients layer 3 switches and routers. I know the syslog messages for the ACL are making it to the MARS. What event type do I need to select and query type do I need to select to get a report on this information?

Thanks.

Dan

[sadbulali · Accepted solution]

You can do a query with the result type "Unknown Event Types" to list all the logs with Unknown Reporting Devices. It will show an "Add Device" button wherever applicable which displays the result set.