How do I forward HEC events with fields staring with underscores?

[Jim_Mulder]

I've configured a HEC to receive events from a Telegraf emitter, which provides metrics in the form:

{"time":1676415410,"event":"metric","host":"VaultNonProd-us-east-2a","index":"vault-metrics","fields":{"_value":0.022299762544379577,"cluster":"vault_nonprod","datacenter":"us-east-2","metric_name":"vault.raft.replication.heartbeat.NonProd-us-east-2b-d992bf60.stddev","metric_type":"timing","role":"vault-server"}}

All of the fields come across from the HF to our indexers except the one we're most interested, the _value field. 

Searching around, I found https://docs.splunk.com/Documentation/DSP/1.3.1/Connection/IndexEvent which, in part, states that "Entries that are not included in fields include: any key that starts with underscore (such as _time)"

Is it possible to include an underscore-starting field in the forwarded event?

Thanks

[Jim_Mulder]

OK, I feel like an idiot.

When collecting metrics, be sure to use a index of datatype 'metrics'