splunk cutting off the top most line of text