Try:
| eval Message=split(Message,".") | eval Short_Message=mvindex(Message,0) |table Short_Message
Edit: Depending on the message you can filter out what lines to show with (Message,0) were 0 is first line. So if you only wan't to show line 3 you can specify eval Short_Message=mvindex(Message,2). In your case the above query should be correct as you only want to show the first line in the message.
... View more
Did you know you can acclerate reports? That might be an easy fix for your problem. But you should also consider the time your search covers. If it's a long span, then you might want to have a look at summary indexing.
... View more