Currently I'm using a tsv sourcetype and customizing my field names for a log file that is tab-delimited. The problem is the final field is the output from a LogCat log file that is also tab delimited. Is there any way I can ignore the tab delimited separations from the LogCat field so that all the information falls under that column?
So for example it's like: date, host, ip, device, ..., crashLog, EXTRA_FIELD_1, EXTRA_FIELD_2, ... But I just want to be able to see all the tab delimited values of the crash log grouped into the one crashLog column.
Anyone know if/how this is possible?
... View more