Updated Event to _raw as splunk requires that as the default field