I have following message format.
2013-06-17 15:33:01+0200 appid="myapplication" responsetimems="155" message="Calling method="calculate" class="math" data="size="98123" rows="9811" firstcolumn="customername"""
Splunk parsed that into following fields
appid = myapplication
responsetimesms = 155
message = Calling method=
class = math
data = size=
rows = 9811
firstcolumn = customername
But I want to
appid = myapplication
responsetimesms 155
message = Calling method="calculate" class="math" data="size="98123" rows="9811" firstcolumn="customername"
method = calculate
class = math
data = size="98123" rows="9811" firstcolumn="customername"
size = 98123
rows = 9811
firstcolumn = customername
How can I do that?