This is the part of Mikrotik for Splunk scipt posted here: http://forum.mikrotik.com/t/tool-using-splunk-to-analyse-mikrotik-logs-4-0-graphing-everything/153043/1
As you see it tries one version to get the health information (new), if that fails, use the old format.
# Collect system health
# ----------------------------------
:if ($SystemHealth) do={
:do {
# New version
:foreach id in=[/system health find] do={
:local health "$[/system health get $id]"
:set ( "$health"->"script" ) "health"
:log info message="$health"
}
} on-error={
# Old version
:if (!([/system health get]~"(state=disabled|^\$)")) do={
:local health "$[/system health get]"
:set ( "$health"->"script" ) "health"
:log info message="$health"
}
}
}