See http://www.splunk.com/base/Documentation/4.1.6/Admin/Transformsconf
NOTE: Keys are case-sensitive. Use the following keys exactly as they appear.
queue : Specify which queue to send the event to (can be parsingQueue, nullQueue, indexQueue).
_raw : The raw text of the event.
_done : If set to any string, this is the last event in a stream.
_meta : A space separated list of metadata for an event.
_time : The timestamp of the event, in seconds since 1/1/1970 UTC.
MetaData:FinalType : The event type of the event.
MetaData:Host : The host associated with the event.
The value must be prefixed by "host::"
_MetaData:Index : The index where the event should be stored.
MetaData:Source : The source associated with the event.
The value must be prefixed by "source::"
MetaData:Sourcetype : The sourcetype of the event.
The value must be prefixed by "sourcetype::"
_TCP_ROUTING : Comma separated list of tcpout group names (from outputs.conf)
Defaults to groups present in 'defaultGroup' for [tcpout].
_HTTP_ROUTING
- NOTE: Any KEY prefixed by '_' is not indexed by Splunk, in general.
Also see transforms.conf.spec
