The role 'unknown' is a catch for all client entries where AMP doesn't receive role data information.
What type of controllers are being monitored? If Aruba, what method of client data collection is being used (SNMP or AMON)? Often times SNMP polling was reduced to lighten load on the controller, which means that traps were relied on, but traps do not contain the role information data. Is this a DMZ setup? If DMZ, is the internal authenticating controller also monitored by AMP? For DMZ setups, we've seen that if you add the external facing controller without the internal authenticating controller, then we only get half of the client auth information.
A next step would be to open a support case to have support collect a data capture and parse that capture to see if AMP is getting the role information in the packets.