I think you're sort of mixing solutions here. If you haven't already, please read up on the phases of data in Splunk.
If you want to do this during the input phase (on your forwarder), then you probably want to play with these settings in your props.conf on the forwarder. For example, something like this maybe (didn't verify)
Or if you want to do it during search time, you can use props/transforms on your search head. You can probably find a lot of examples like this out here and it's documented in the spec files as well. Something like this maybe (didn't verify).