fix: Splunk metadata parsing logic

fix: Splunk metadata parsing logic #1487