I am sending events into Splunk using a tool that has a notification engine. The notification engine only allows me to set a value which then extracts the message attribute for forwarding. For instance I set the value "$reason" and what gets sent for that value can be one or many words. When the value sent is more than one word, Splunk will only parse the first word. Hence if the field in the syslog message is "event_id=Added registered device for user: jdoe", splunk will show it as "event_id Added". How do I get Splunk to read in the entire message knowing that I can't do anything to adjust the way the source sends it? ... View more