Here is the custom event log format:
field1 field2 field3 FREE_TEXT
How would one query, say Top 10, FREE_TEXT ignoring first 3 fields which are space separated. FREE_TEXT can be any application level debug message which is not a fixed format.
Creating Fields is not an option. Neither is the code change to generate standard log format like Apache web log.
Just a single instance Splunk server(no clustering).
Why is creating fields not an option? Even if you don't want fields for all searches, you can create per-search fields using the rex command.
You should be able to do something like:
... | rex field=_raw "^[^ ]+ [^ ]+ [^ ]+ (?<free_text>.+)" | top limit=10 free_text