diff --git a/.idea/misc.xml b/.idea/misc.xml
index 10f4f51..7e25d8b 100644
--- a/.idea/misc.xml
+++ b/.idea/misc.xml
@@ -3,8 +3,8 @@
   <component name="JavaScriptSettings">
     <option name="languageLevel" value="ES6" />
   </component>
-  <component name="ProjectRootManager" version="2" project-jdk-name="Remote Python 3.7.4 Docker Compose (test at [/Users/rfaircloth/Documents/GitHub/splunk-connect-for-syslog/docker-compose.yml])" project-jdk-type="Python SDK" />
+  <component name="ProjectRootManager" version="2" project-jdk-name="Remote Python 3.7.4 Docker Compose (test at [/Users/mbonsack/Splunk/SE_Tools/syslog/SC4S/splunk-connect-for-syslog/docker-compose.yml])" project-jdk-type="Python SDK" />
   <component name="PythonCompatibilityInspectionAdvertiser">
     <option name="version" value="3" />
   </component>
-</project>
+</project>
\ No newline at end of file
diff --git a/.idea/splunk-connect-for-syslog.iml b/.idea/splunk-connect-for-syslog.iml
index 3b1d69b..14d7789 100644
--- a/.idea/splunk-connect-for-syslog.iml
+++ b/.idea/splunk-connect-for-syslog.iml
@@ -2,7 +2,7 @@
 <module type="PYTHON_MODULE" version="4">
   <component name="NewModuleRootManager">
     <content url="file://$MODULE_DIR$" />
-    <orderEntry type="jdk" jdkName="Remote Python 3.7.4 Docker Compose (test at [/Users/rfaircloth/Documents/GitHub/splunk-connect-for-syslog/docker-compose.yml])" jdkType="Python SDK" />
+    <orderEntry type="jdk" jdkName="Remote Python 3.7.4 Docker Compose (test at [/Users/mbonsack/Splunk/SE_Tools/syslog/SC4S/splunk-connect-for-syslog/docker-compose.yml])" jdkType="Python SDK" />
     <orderEntry type="sourceFolder" forTests="false" />
   </component>
   <component name="TemplatesService">
@@ -16,4 +16,4 @@
     <option name="projectConfiguration" value="pytest" />
     <option name="PROJECT_TEST_RUNNER" value="pytest" />
   </component>
-</module>
+</module>
\ No newline at end of file
diff --git a/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf b/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf
new file mode 100644
index 0000000..3c8192b
--- /dev/null
+++ b/package/etc/conf.d/conflib/vendor_cisco/nx-os.conf
@@ -0,0 +1,3 @@
+filter f_cisco_nx-os {
+    match("cisco_nx-os", value("fields.sc4s_vendor_product") type(glob) );
+};
\ No newline at end of file
diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf
new file mode 100644
index 0000000..025ba55
--- /dev/null
+++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf
@@ -0,0 +1,14 @@
+log {
+
+    source(s_default-ports);
+    filter(f_cisco_nx-os);
+
+    parser {
+            p_add_context_splunk(key("cisco:nx-os"));
+    };
+    rewrite {
+        r_set_splunk(template("t_standard"))
+    };
+    destination(d_hec);  #--HEC--
+    flags(flow-control);
+};
\ No newline at end of file
diff --git a/package/etc/context-local/splunk_index.csv b/package/etc/context-local/splunk_index.csv
index c1167c5..58a2010 100644
--- a/package/etc/context-local/splunk_index.csv
+++ b/package/etc/context-local/splunk_index.csv
@@ -4,6 +4,8 @@ cisco:asa,index,main
 cisco:asa,sourcetype,cisco:asa
 cisco:ios,index,main
 cisco:ios,sourcetype,cisco:ios
+cisco:nx-os,index,main
+cisco:nx-os,sourcetype,cisco:nx-os
 fgt_event,sourcetype,fgt_event
 fgt_event,index,main
 fgt_log,sourcetype,fgt_log
diff --git a/package/etc/context-local/vendor_product_by_source.conf b/package/etc/context-local/vendor_product_by_source.conf
index 2830c3b..215d5f6 100644
--- a/package/etc/context-local/vendor_product_by_source.conf
+++ b/package/etc/context-local/vendor_product_by_source.conf
@@ -22,4 +22,8 @@ filter f_juniper_idp {
 filter f_juniper_netscreen {
     host("jnpns-*" type(glob) )
     or match("juniper_netscreen" value("fields.sc4s_presume"))
+};
+filter f_cisco_nx-os {
+    host("csconx-*" type(glob) )
+    or match("cisco_nx-os" value("fields.sc4s_presume"))
 };
\ No newline at end of file
diff --git a/package/etc/context-local/vendor_product_by_source.csv b/package/etc/context-local/vendor_product_by_source.csv
index 0d9e6c0..e04b149 100644
--- a/package/etc/context-local/vendor_product_by_source.csv
+++ b/package/etc/context-local/vendor_product_by_source.csv
@@ -2,4 +2,5 @@ f_test_test,sc4s_vendor_product,"test_test"
 f_juniper_nsm,sc4s_vendor_product,"juniper_nsm"
 f_juniper_nsm_idp,sc4s_vendor_product,"juniper_nsm_idp"
 f_juniper_idp,sc4s_vendor_product,"juniper_idp"
-f_juniper_netscreen,sc4s_vendor_product,"juniper_netscreen"
\ No newline at end of file
+f_juniper_netscreen,sc4s_vendor_product,"juniper_netscreen"
+f_cisco_nx-os,sc4s_vendor_product,"cisco_nx-os"
\ No newline at end of file
diff --git a/tests/test_cisco_nx_os.py b/tests/test_cisco_nx_os.py
new file mode 100644
index 0000000..d44e009
--- /dev/null
+++ b/tests/test_cisco_nx_os.py
@@ -0,0 +1,55 @@
+# Copyright 2019 Splunk, Inc.
+#
+# Use of this source code is governed by a BSD-2-clause-style
+# license that can be found in the LICENSE-BSD2 file or at
+# https://opensource.org/licenses/BSD-2-Clause
+
+from jinja2 import Environment
+
+from .sendmessage import *
+from .splunkutils import *
+
+env = Environment(extensions=['jinja2_time.TimeExtension'])
+
+# Nov 1 14:07:58 excal-113 %MODULE-5-MOD_OK: Module 1 is online
+def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk):
+    host = get_host_key
+
+    mt = env.from_string(
+        "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} csconx-{{ host }} %MODULE-5-MOD_OK: Module 1 is online")
+    message = mt.render(mark="<111>", host=host)
+
+    sendsingle(message)
+
+    st = env.from_string("search index=main host=\"csconx-{{ host }}\" sourcetype=\"cisco:nx-os\" | head 2")
+    search = st.render(host=host)
+
+    resultCount, eventCount = splunk_single(setup_splunk, search)
+
+    record_property("host", host)
+    record_property("resultCount", resultCount)
+    record_property("message", message)
+
+    assert resultCount == 1
+
+# Nov 1 14:07:58 excal-113 %MODULE-5-MOD_OK: Module 1 is online
+# @pytest.mark.xfail
+#def test_cisco_nx_os_singleport(record_property, setup_wordlist, get_host_key, setup_splunk):
+#    host = get_host_key
+#
+#    mt = env.from_string(
+#        "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} %MODULE-5-MOD_OK: Module 1 is online")
+#    message = mt.render(mark="<23>", host=host)
+#
+#    sendsingle(message, host="sc4s-nx-os")
+#
+#    st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cisco:nx-o\" | head 2")
+#    search = st.render(host=host)
+#
+#    resultCount, eventCount = splunk_single(setup_splunk, search)
+#
+#    record_property("host", host)
+#    record_property("resultCount", resultCount)
+#    record_property("message", message)
+#
+#    assert resultCount == 1
\ No newline at end of file