Here are a few of the entries that are coming in from my Cisco devices that are not matching against the TA_cisco-ios Splunk App. These are coming in from ASR9K IOS-XR devices. Feb 27 14:33:24 XX.XX.XX.XX 516048: RP/0/RSP1/CPU0:Feb 27 14:33:24.336 CST: exec[65788]: %SECURITY-login-4-AUTHEN_FAILED : Failed authentication attempt by user 'USERNAME' from 'YY.YY.YY.YY' on 'vty0' Feb 27 14:29:04 XX.XX.XX.XX 138890: LC/0/1/CPU0:Feb 28 02:29:41.007 UTC: ntpdc[207]: %IP-IPNTP-5-SYNCLOSS : Synchronization lost : DLRSC node : The clock was stepped and needs to be resynced ... View more