Splunk Search

Send certain fields to null queue


We are indexing logs from network devices and we need to reject or send certain fields to null queue.

The logs looks like this-
Fri Aug 24 14:59:47 2012 sensor__id=101 event_id=1111 event_sec=192134787 event_usec=213341 sid=4 gen=1 rev=6 class=33 priority=1 src_addr= dst_addr=

We have field "sensor_id" and from the above example we have "sensor_id=101". SO we want logs only from the sensor__id=101 and reject any logs from other sensor_id=1 or sensor_id=2 ...

Need you help in regex for fixing this!!

Tags (2)
0 Karma


There are loads of questions covering this on splunkbase. The docs has very helpful sections on it, too: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Discard_specific_event...

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...