Grouping a tab-delimited log file within a log entry.

[ajkueterman]

Currently I'm using a tsv sourcetype and customizing my field names for a log file that is tab-delimited. The problem is the final field is the output from a LogCat log file that is also tab delimited. Is there any way I can ignore the tab delimited separations from the LogCat field so that all the information falls under that column?

So for example it's like: date, host, ip, device, ..., crashLog, EXTRA_FIELD_1, EXTRA_FIELD_2, ... But I just want to be able to see all the tab delimited values of the crash log grouped into the one crashLog column.

Anyone know if/how this is possible?

[NOUMSSI]

Hi;
add this search code at the end of your query:

...|table crashLog