I can see that the stock query is not formatted in a way that likes the output of the forwarding server. Namely the CPU="all" part.
How do i set up the index/sourcetype/etc. so it can be categorized correctly? Or if i can adjust the query to regex through accordingly.