Cisco events not matched

[duane_wylie]

I have some syslog messages coming from my Cisco devices that are not being identified by the TA. How would I go about extending the app to capture these messages?

[mikaelbje]

Some IOS XR devices have a slightly different log format. I've made some changes to the app to also capture those events. Could you please try the latest version of the app (currently 2.0.0) and see if they're matched now?

[duane_wylie]

Here are a few of the entries that are coming in from my Cisco devices that are not matching against the TA_cisco-ios Splunk App. These are coming in from ASR9K IOS-XR devices.

Feb 27 14:33:24 XX.XX.XX.XX 516048: RP/0/RSP1/CPU0:Feb 27 14:33:24.336 CST: exec[65788]: %SECURITY-login-4-AUTHEN_FAILED : Failed authentication attempt by user 'USERNAME' from 'YY.YY.YY.YY' on 'vty0'

Feb 27 14:29:04 XX.XX.XX.XX 138890: LC/0/1/CPU0:Feb 28 02:29:41.007 UTC: ntpdc[207]: %IP-IPNTP-5-SYNCLOSS : Synchronization lost : DLRSC node : The clock was stepped and needs to be resynced