wcooley/splunk-puppet — pull request #1 by tfhartmann (2013-04-04 02:28:40+00:00)
Title: Updated field extractions to use sourcetype=syslog

Since RHEL logs puppet agent and master to /var/log/messages some fields weren't extracting, I updated props and transforms to extract fields from both sources, which seemed to work..