Getting Data In

Grouping a tab-delimited log file within a log entry.

ajkueterman
New Member

Currently I'm using a tsv sourcetype and customizing my field names for a log file that is tab-delimited. The problem is the final field is the output from a LogCat log file that is also tab delimited. Is there any way I can ignore the tab delimited separations from the LogCat field so that all the information falls under that column?

So for example it's like: date, host, ip, device, ..., crashLog, EXTRA_FIELD_1, EXTRA_FIELD_2, ... But I just want to be able to see all the tab delimited values of the crash log grouped into the one crashLog column.

Anyone know if/how this is possible?

Tags (2)
0 Karma

NOUMSSI
Builder

Hi;
add this search code at the end of your query:

...|table crashLog

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!