I think the answer is "no" (as of Splunk Enterprise 6.4), but I thought it was worth checking, because this might affect what fields and values I send to Splunk (typically, in JSON; via TCP, or possibly HEC).
If the answer is a straightforward "no", then the rest of this question, which describes my use case, is more or less academic.
the following per-event source type override in transforms.conf:
REGEX = \"type\":\"([^\"]+)\",\"code\":\"([^\"]+)\"
FORMAT = sourcetype::\L$1_$2
results in a sourcetype field value of \LXYZ_A1B2 - that is, with a leading backlash and capital L - rather than the desired xyz_a1b2.
If the answer is, as I expect, "no", then I see the following options:
Instead of sending JSON with the current type and code fields, send JSON with a "precanned" single field, such as event_sourcetype, with the field value xyz_a1b2, already in lowercase. (The event_ field name prefix is to keep the field name separate from the default sourcetype field; yes, I've tried using the field name sourcetype in the input JSON). This would allow for a simpler source type override stanza (one matching field, one back reference).
Send type and code field values as lowercase.
Live with the uppercase (as is) sourcetype field value XYZ_A1B2.