---
title: "network.cisco"
canonical: "https://docs.devo.com/space/latest/349732889/network.cisco"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `network.cisco` identify events generated by network products provided by [Cisco](https://www.cisco.com/).

## Valid tags and data tables 

The full tag must have at least 2 levels. The first two are fixed as** **`network.cisco`. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Cisco | `network.cisco` | `network.cisco` |
| `network.cisco.router` | `network.cisco.router` |
| `network.cisco.switch` | `network.cisco.switch` |
| `network.cisco.wireless` | `network.cisco.wireless` |
| `network.cisco.wlc` | `network.cisco.wlc` |

For more information, read more [About Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## Send it

Example relay rules:

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: network.cisco.router
Sent without syslog tag: true
        Stop processing: true
```


```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: network.cisco.router
Sent without syslog tag: true
```

## How is the data sent to Devo?

Data may be sent with the Devo Relay.

Example relay rule:

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: network.cisco.router
Sent without syslog tag: true
```

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [network.cisco](#tag1)
> - [network.cisco.router](#tag2)
> - [network.cisco.switch](#tag3)
> 
> ### > Macro (anchor)
> 
> network.cisco
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *type* | `str` |  | *vtype* |  |
> | *machine* | `str` |  | * * |  |
> | *hostname* | `str` | ```
> ifthenelse(_hostname = "", null(""), _hostname)
> ``` | *_hostname* |  |
> | *seqNumber* | `str` | ```
> ifthenelse(_seqNumber = "", null(""), _seqNumber)
> ``` | *_seqNumber* |  |
> | *task* | `str` |  | * * |  |
> | *serverdate* | `str` |  | * * |  |
> | *facility* | `str` |  | * * |  |
> | *priority* | `int4` |  | * * |  |
> | *mnemonic* | `str` |  | * * |  |
> | *message* | `str` |  | * * |  |
> | *interface* | `str` |  | * * |  |
> | *speed* | `str` |  | * * |  |
> | *status* | `str` |  | * * |  |
> | *reason* | `str` |  | * * |  |
> | *duplex_mode* | `str` |  | * * |  |
> | *rec_flow_ctrl* | `str` |  | * * |  |
> | *tra_flow_ctrl* | `str` |  | * * |  |
> | *call_home_event* | `str` |  | * * |  |
> | *sys_action* | `str` |  | * * |  |
> | *system_msg* | `str` |  | * * |  |
> | *process* | `str` |  | * * |  |
> | *proc_id* | `str` |  | * * |  |
> | *host_and_port* | `str` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | *rawSource* | **✓** |
> 
> ### > Macro (anchor)
> 
> network.cisco.router
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *machine* | `str` |  | * * |  |
> | *hostname* | `str` | ```
> ifthenelse(_hostname = "", null(""), _hostname)
> ``` | *_hostname* |  |
> | *seqNumber* | `str` | ```
> ifthenelse(_seqNumber = "", null(""), _seqNumber)
> ``` | *_seqNumber* |  |
> | *task* | `str` |  | * * |  |
> | *serverdate* | `str` |  | * * |  |
> | *facility* | `str` |  | * * |  |
> | *priority* | `int4` |  | * * |  |
> | *mnemonic* | `str` |  | * * |  |
> | *message* | `str` |  | * * |  |
> | *SIP0* | `str` |  | * * |  |
> | *list_name* | `str` |  | * * |  |
> | *action* | `str` |  | * * |  |
> | *protocol* | `str` |  | * * |  |
> | *srcIp* | `ip4` |  | * * |  |
> | *src_port* | `str` |  | * * |  |
> | *dstIp* | `ip4` |  | * * |  |
> | *dst_port* | `str` |  | * * |  |
> | *packet_count* | `str` |  | * * |  |
> | *interface* | `str` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | *rawSource* | **✓** |
> 
> ### > Macro (anchor)
> 
> network.cisco.switch
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *hostchain* | `str` |  | * * |  |
> | *machine* | `str` |  | * * |  |
> | *hostname* | `str` | ```
> ifthenelse(_hostname = "", null(""), _hostname)
> ``` | *_hostname* |  |
> | *seqNumber* | `str` | ```
> ifthenelse(_seqNumber = "", null(""), _seqNumber)
> ``` | *_seqNumber* |  |
> | *task* | `str` |  | * * |  |
> | *serverdate* | `str` |  | * * |  |
> | *facility* | `str` |  | * * |  |
> | *priority* | `int4` |  | * * |  |
> | *mnemonic* | `str` |  | * * |  |
> | *user* | `str` |  | * * |  |
> | *srcIp* | `ip4` |  | * * |  |
> | *message* | `str` |  | * * |  |
> | *SIP0* | `str` |  | * * |  |
> | *list_name* | `str` |  | * * |  |
> | *action* | `str` |  | * * |  |
> | *protocol* | `str` |  | * * |  |
> | *src_port* | `str` |  | * * |  |
> | *dstIp* | `ip4` |  | * * |  |
> | *dst_port* | `str` |  | * * |  |
> | *packet_count* | `str` |  | * * |  |
> | *interface* | `str` |  | * * |  |
> | *speed* | `str` |  | * * |  |
> | *status* | `str` |  | * * |  |
> | *reason* | `str` |  | * * |  |
> | *duplex_mode* | `str` |  | * * |  |
> | *rec_flow_ctrl* | `str` |  | * * |  |
> | *tra_flow_ctrl* | `str` |  | * * |  |
> | *call_home_event* | `str` |  | * * |  |
> | *sys_action* | `str` |  | * * |  |
> | *system_msg* | `str` |  | * * |  |
> | *process* | `str` |  | * * |  |
> | *proc_id* | `str` |  | * * |  |
> | *host_and_port* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | *rawSource* | **✓** |
> 
> > Macro (rw-tab)
> 
> - [network.cisco.wireless](#tag4)
> - [network.cisco.wlc](#tag5)
> 
> ### > Macro (anchor)
> 
> network.cisco.wireless
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *machine* | `str` |  | * * |  |
> | *hostname* | `str` | ```
> ifthenelse(_hostname = "", null(""), _hostname)
> ``` | *_hostname* |  |
> | *seqNumber* | `str` | ```
> ifthenelse(_seqNumber = "", null(""), _seqNumber)
> ``` | *_seqNumber* |  |
> | *task* | `str` |  | * * |  |
> | *serverdate* | `str` |  | * * |  |
> | *facility* | `str` |  | * * |  |
> | *priority* | `int4` |  | * * |  |
> | *mnemonic* | `str` |  | * * |  |
> | *message* | `str` |  | * * |  |
> | *server* | `str` |  | * * |  |
> | *process* | `str` |  | * * |  |
> | *client_mac* | `str` |  | * * |  |
> | *user* | `str` |  | * * |  |
> | *source_ip* | `ip4` |  | *srcIp* |  |
> | *ap_name* | `str` |  | * * |  |
> | *bssid_mac* | `str` |  | * * |  |
> | *source_name* | `str` |  | * * |  |
> | *excluded_client_mac* | `str` |  | * * |  |
> | *excluded_source_ip* | `ip4` |  | * * |  |
> | *reason* | `str` |  | * * |  |
> | *message_description* | `str` |  | * * |  |
> | *qfp* | `str` |  | * * |  |
> | *thread* | `str` |  | * * |  |
> | *ts* | `str` |  | * * |  |
> | *external_groups* | `str` |  | * * |  |
> | *ifid* | `str` |  | * * |  |
> | *current_ifid* | `str` |  | * * |  |
> | *ssid* | `str` |  | * * |  |
> | *interface* | `str` |  | * * |  |
> | *auth_failure_reason* | `str` |  | * * |  |
> | *audit_sessionid* | `str` | ```
> ifthenelse(audit_sessionid_str -> ".", split(audit_sessionid_str, ".", 0), audit_sessionid_str)
> ``` | *audit_sessionid_str* |  |
> | *source_port* | `int4` |  | *srcPort* |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | *rawSource* | **✓** |
> 
> ### > Macro (anchor)
> 
> network.cisco.wlc
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *machine* | `str` |  |  |
> | *facility* | `str` |  |  |
> | *priority* | `int4` |  |  |
> | *mnemonic* | `str` |  |  |
> | *message* | `str` |  |  |
> | *chassis_1_r0_0* | `str` |  |  |
> | *wncmgrd* | `str` |  |  |
> | *client_mac* | `str` |  |  |
> | *ap_name* | `str` |  |  |
> | *bssid_mac* | `str` |  |  |
> | *reason* | `str` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` | *rawSource* | **✓** |