Send certain fields to null queue

[npandith]

We are indexing logs from network devices and we need to reject or send certain fields to null queue.

The logs looks like this-
Fri Aug 24 14:59:47 2012 sensor__id=101 event_id=1111 event_sec=192134787 event_usec=213341 sid=4 gen=1 rev=6 class=33 priority=1 src_addr=192.168.0.33 dst_addr=192.169.0.55

We have field "sensor_id" and from the above example we have "sensor_id=101". SO we want logs only from the sensor__id=101 and reject any logs from other sensor_id=1 or sensor_id=2 ...

Need you help in regex for fixing this!!

[Ayn]

There are loads of questions covering this on splunkbase. The docs has very helpful sections on it, too: http://docs.splunk.com/Documentation/Splunk/latest/Deploy/Routeandfilterdatad#Discard_specific_event...