Changing the normalization would be a feature request to Support.
You can setup LEM to collect the raw messages, take a look here:
Thanks for the response. I already have LEM configured to collect raw messages, but I guess I'm not sure now how I search the raw data.
This line from the link you provided is what's confusing:
nDepth uses RAW data (the original log) and is different from the nDepth Search performed in the LEM console at Explore > nDepth.
So if nDepth from the LEM console is not searching the raw data, how do I access the raw logs?
When you enable the raw log capture, you'll have a new option in the Explore --> nDepth screen to look exclusively at the raw logs.