syslog: fix forwarding to splunk