In split, using parentheses in the regular expression captures the separators as well. So split /(\[.*?\])/ will split your string into the pieces in brackets and the others assuming a well-formed input and no nesting. Then do the replacing and join everything together again.

use strict;
use warnings;

my $input = '[8/29/2013 7:16:45 AM] User abc def [DEFAULT] [8/29/2013 
+7:16:45 AM] User xyz abc [DEFAULT]';
my $output = join '', map { s/\s/\t/g if /\[/; $_ } split /(\[.*?\])/,
+ $input;
print "$output\n";
[download]