Prop & Transform a Sourcetype & a Sentenc

[TitanAE]

I have a Prop & Transform file. In it, I'm trying to parse a specific field and label it as a source type. I had it working before but now... it's a bit broken.

Transforms.conf

[audit_sourcetype_11]
REGEX = (AUDIT_Sourcetype_1)
FORMAT = sourcetype::Sourcetype_1_Name
DEST_KEY = MetaData:Sourcetype

[audit_sourcetype_22]
REGEX = (AUDIT_Sourcetype_22)
FORMAT = sourcetype::Sourcetype_2_Name
DEST_KEY = MetaData:Sourcetype

Props.conf

disabled = false
NO_BINARY_CHECK = true
disabled = false
pulldown_type = true

The other issue I'm having is that I have certain events and messages that show up like this:

[ System_Message = This is a system message ]

However Splunk parses it and displays it like this:

Field: System_Message
Value: This

How do I tell Splunk to look at the entire message. Not just the first character? In the same Transforms.conf?

[HiroshiSatoh]

It is not a configuration file of the field definition.
If the field definition is bad, why not try redefining it from the GUI?