You should change the the metadata separator to something different than newline, e.g. a space with metadataDelimiter=" ", otherwise splunk will interpret the metadata lines as new events. Adding the line to the syslog config should be all you need. Afte changing appidconfig.conf you should restart purview with appidctl restart. I don't remember if you need to restart syslog after changing the rsyslog.d, if you changes are not immediately applied try restarting the syslog daemon (probably with service rsyslog restart, I don't remember either, I usually reboot the whole appliance but a service restart should suffice)
