I would like to replace the "action" field so it conforms with the CIM datamodel.
action at present will alway equal either "Successful" or "error".
I would like to replace "Successful" to "success" and "error" to "failure".
After field replacement
You might explore creating a field alias for those fields under settings > fields > field alias
Splunk references field aliases as a first step under "Make your fields CIM-compliant" in the Common Information Model Add-on Manual. There are step by step instructions for various tasks: http://docs.splunk.com/Documentation/CIM/4.8.0/User/UsetheCIMtonormalizedataatsearchtime
Also, search time field extractions are recommended over index time: