[samplelog.cisco.ios]
interval = 60
earliest = -10m
latest = now
mode = sample
sourcetype = cisco:ios
count = 100
randomizeCount = 0.25

##replace timestamp
token.0.token = \w{3}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}
token.0.replacementType = timestamp
token.0.replacement = %b %e %H:%M:%S
##replacing Hostname
token.1.token = H{8}
token.1.replacementType = random
token.1.replacement = list[ "osl-c-001-rtr-1", "osl-e-310-swi-1", "cph-c-001-rtr-1", "sto-c-001-rtr-1", "hel-c-001-rtr-1", "osl-e-310-swi-2", "osl-e-310-swi-3", "cph-e-951-swi-1" ]
##replace user
token.2.token = U{8}
token.2.replacementType = random
token.2.replacement = list[ "svc-nms", "bdylan", "gclooney", "fallback", "ppan", "hbaldwin", "mjordan", "mmouse" ]
##replacing remaining ip
token.3.token = XXX\.XXX\.XXX\.XXX
token.3.replacementType = random
token.3.replacement = ipv4
##replace interface
token.4.token = _INTERFACE_
token.4.replacementType = random
token.4.replacement = list[ "Ethernet1/0/1", "Ethernet1/0/2", "Ethernet1/0/3", "Ethernet1/0/4", "Ethernet1/0/5", "Ethernet1/0/6", "Ethernet1/0/7", "Ethernet1/0/8", "Ethernet1/0/9", "Ethernet1/0/10", "Ethernet1/0/11", "Ethernet1/0/12", "Ethernet1/0/13", "Ethernet1/0/14", "Ethernet1/0/15", "Ethernet1/0/16", "Ethernet1/0/17", "Ethernet1/0/18", "Ethernet1/0/19", "Ethernet1/0/20", "Ethernet1/0/21", "Ethernet1/0/22", "Ethernet1/0/23", "Ethernet1/0/24", "Ethernet1/0/25", "Ethernet1/0/26", "Ethernet1/0/27", "Ethernet1/0/28", "Ethernet1/0/29", "Ethernet1/0/30", "Ethernet1/0/31", "Ethernet1/0/32", "Ethernet1/0/33", "Ethernet1/0/34", "Ethernet1/0/35", "Ethernet1/0/36", "Ethernet1/0/37", "Ethernet1/0/38", "Ethernet1/0/39", "Ethernet1/0/40", "Ethernet1/0/41", "Ethernet1/0/42", "Ethernet1/0/43", "Ethernet1/0/44", "Ethernet1/0/45", "Ethernet1/0/46", "Ethernet1/0/47", "Ethernet1/0/48", "FastEthernet0/0", "FastEthernet0/1" ]
##replace logical_interface
token.5.token = _LOGICALINTERFACE_
token.5.replacementType = random
token.5.replacement = list[ "vlan 1110", "vlan 1111", "vlan 1112", "vlan 1113", "vlan 1114", "vlan 1115", "vlan 1116", "vlan 1117" ]
##replace _EVENT_ID_
token.6.token = _EVENT_ID_
token.6.replacementType = random
token.6.replacement = integer[0:99999]
##replace _PORT_NUMBER_
token.7.token = _PORT_NUMBER_
token.7.replacementType = random
token.7.replacement = integer[0:65535]
##replace interface_short
token.8.token = _INTERFACESHORT_
token.8.replacementType = random
token.8.replacement = list[ "Fa1/0/1", "Gi1/2/1", "Fa1/0/32", "Gi4/0/1", "Gi4/0/2", "Gi4/0/3", "Gi4/0/4", "Gi4/0/5", "Gi4/0/6", "Gi0/1", "Gi0/2", "Gi0/3", "Gi0/4", "Gi0/5", "Gi0/6", "Gi0/7", "Eth1/0/8", "Eth1/0/9", "Eth1/0/10", "Eth1/0/11", "Eth1/0/12" ]