something specific that would help? the CmdSet field is what im searching against, in this case it is identical for all the events aside from a time stamp and the device name.
Feb 15 02:05:29,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=ONE-SOME-ROUTER
Feb 15 02:05:29,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=TWO-SOME-ROUTER
Feb 10 04:02:11,CmdSet=[ CmdAV=ip prefix-list BAD-CUST seq 1 permit 10.20.30.40/32 ], NetworkDeviceName=ONE-SOME-ROUTER
... View more