i configured a Cisco switch with "login on-failure log" to log failed authentications to my splunk server. Unfortunately, these events have host=GMTS in splunk instead of the real hostname (host=switchname). Other events from the same switch do not have this problem.
These events look like:
<189>38677: switchname: 038673: Oct 14 12:11:02.419: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: username] [Source: 10.10.10.10] [localport: 22] at 12:11:02 GMTS Thu Oct 14 2010