responding late since i ran into this and was left scratching my help.
so hopefully this helps someone else.
you have to very careful with the source data format (what is being logged in the log files by the web server).
in my case, i was using a CustomLog configuration in Apache, and using an unused field (%l - Remote logname), with some request header value but was double quoting the value.
splunk wasn't quite liking that, once i removed the double quotes, splunk loved it.
