Grouping a tab-delimited log file within a log entry.

ajkueterman — Mon, 28 Sep 2020 19:24:56 GMT

Currently I'm using a tsv sourcetype and customizing my field names for a log file that is tab-delimited. The problem is the final field is the output from a LogCat log file that is also tab delimited. Is there any way I can ignore the tab delimited separations from the LogCat field so that all the information falls under that column?

So for example it's like: date, host, ip, device, ..., crashLog, EXTRA_FIELD_1, EXTRA_FIELD_2, ... But I just want to be able to see all the tab delimited values of the crash log grouped into the one crashLog column.

Anyone know if/how this is possible?

Re: Grouping a tab-delimited log file within a log entry.

NOUMSSI — Fri, 03 Apr 2015 14:53:15 GMT

Hi;
add this search code at the end of your query:

...|table crashLog

topic Grouping a tab-delimited log file within a log entry. in Getting Data In

Grouping a tab-delimited log file within a log entry.

Re: Grouping a tab-delimited log file within a log entry.