Updated to remove false positives

.. and changes to make this work on Splunk 6.0