better handling of splunk formatted data