how config to auto parser cef with just use kv

[siv]

i just installed CEF Extraction add-on for splunk
i want to try this for example 

| makeresults
| eval _raw="CEF:0|vendor|product|1.0|TestEvent|5| filename=name.txt ip=10.10.1.2 fullname=mike reacher status=ok"
| kv
| table fullname filename ip *

why it didnt work..
all this because  default kv dont support multi string with whitespace

[PickleRick]

I'm not sure if any already defined sourcetypes come with the add-on. The description says it provides transforms and some example props.conf but you have to see into it for yourself. Anyway, if kv is to do its job, it must know what sourcetype it's dealing with. With makeresults you haven't provided any.

Anyway, this add-on seems strange. It says it extracts some fields in index time. Unless it's the time, it seems like an overkill.

[marnall]

I couldn't tell you how to get it to work with makeresults, but if you input a CEF log with the sourcetype "cefevents", then the CEF field extractions should work.

[siv]

?