See this: http://answers.splunk.com/answers/239387/why-is-the-splunk-add-on-for-amazon-web-services-n.html#answer-238615 Probably the same thing for you. Probably normal and expected. ... View more

If this is syslog, and your timestamps and events are being recognized correctly, you can use the Field Extractor Utility to extract fields as you desire. And then using the fields and outputcsv commands, you can format how you want your CSV to look. Other options as mentioned are using props and transforms to create your own extractions and fields. ... View more