Consider using the RFC5424 Syslog technical add-on http://apps.splunk.com/app/978/. Sounds like exactly what you are looking for 🙂 caveats from documentation are listed below as of v1.0 of the said app: KNOWN ISSUES/LIMITATIONS - Fields which appear more than once in an event (i.e., field1="value1" field1="value2") will not be evaluated as multi-value fields - Within a structured data block, the SDID is not associated with the local field names; it is simply another multi-value field, "sdid" - The MSG section of the event, if it exists, is not parsed by this app. ... View more