Is there a way to insert values into events before they are indexed? We need to be able to insert string literals into our events before they are indexed.
If not happy with the answer, give us a scenario and details on how the inserts are valuable. There might be other ways to skin the cat than inserting literals.
Take a look at the REGEX and FORMAT attributes in the transforms.conf file. See http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf.