add JsonSplunkParser to output JSON which seems to be more reliably parsed by Splunk Indexers