I have a week trying to replace the default TAB delimiter for comma, so far I got this:
<Extension _syslog> Module xm_syslog Delimiter , </Extension> <Input in> Module im_msvistalog </Input> <Output out> Module om_tcp Host 192.168.1.2 Port 514 Exec to_syslog_snare(); </Output> <Route 1> Path in => out </Route>
I also try changing , for 0x2C Sadly doesn't work, all I can see is the delimiter change for a extrange character . I'm using the latest community version. I really hope that someone help me with a clear answer.