I have the Cisco ISE app loaded and there is a field, `Framed_IPv6_Address` that may contain up to six IPv6 addresses. Raw event snippet looks like this:
Framed-IPv6-Address=, Framed-IPv6-Address=, Framed-IPv6-Address=, etc
When I try mvexpand `index=cisco sourcetype="cisco:ise:syslog" | mvexpand Framed_IPv6_Address` I am getting some, but not all of the IPv6 addresses returned as values.
Any ideas on how I can get all IPv6 values listed?
Thx
↧