G'day amparida,

Welcome to the monastery.

Your problem is "$_ =~ s/\s+/\t/g;" which targets all spaces, not just those within the brackets.

If you have Perl 5.14.0 (or later), you can do this:

$ perl -Mstrict -Mwarnings -E '
    my $x = "[8/29/2013 7:16:45 AM] User abc def [DEFAULT]";
    $x =~ s{\[([^\]]*)\]}{"[" . $1 =~ y/ /\t/r . "]"}eg;
    say $x;
' | cat -vet
[8/29/2013^I7:16:45^IAM] User abc def [DEFAULT]$
[download]

For earlier versions, this works:

$ perl -Mstrict -Mwarnings -E '
    my $x = "[8/29/2013 7:16:45 AM] User abc def [DEFAULT]";
    $x =~ s{\[([^\]]*)\]}{"[" . do { (my $y = $1) =~ y/ /\t/; $y } . "
+]"}eg;
    say $x;
' | cat -vet
[8/29/2013^I7:16:45^IAM] User abc def [DEFAULT]$
[download]

[Note: cat -vet shows tabs as "^I" and newlines as "$".]

Update (Perl version clarification): My reference to Perl 5.14.0 relates to the use of the 'r' modifier in 'y/ /\t/r'. After posting, I noticed I'd also used '-E' and 'say $x;'; for versions prior to 5.10.0, use '-e' and 'print "$x\n";'.