Hello,
Could you share which of the following options your colleague who set it up has enabled?
1-Syslog
2-PostgreSQL
3-REST API
The clearest way to quickly find which management is being used is to look under Grafana > settings > data sources.
On the ClearPass side, you can find it under Administration > External Servers > Syslog Targets.
If the definitions are set up to be syslog servers, they may have been configured with the following logic:
The client connects to the network > Cisco WLC (or Aruba AP) sends RADIUS Auth + Accounting (Start / Interim-Update / Stop) packets to ClearPass.
ClearPass logs these events in Access Tracker.
ClearPass sends the text of these events as syslog to a collector (Elasticsearch, etc.) according to the Log Export / Syslog Target definitions.
Grafana makes that collector a Data Source and generates panels/metrics from the logs.
In other words, Grafana does not read directly from ClearPass; it reads through the syslog collector in between.
-------------------------------------------