updated to splunk format from CEF (ArcSight)