Allow ability to change a default index

[traytonwhite]

Currently it seems with the splunk_metadata.csv you must iterate over an exhaustive list of vendor_product combinations to switch a default index to something else. It'd be nice to have a way to fully replace a default index with another option.

An example would be how there's a default index of osnix - if one would like to have all the data that would normally go to osnix to instead go to an index called foo, goal of this enhancement request would be to have that as an option via the metadata config files.

[rjha-splunk]

@mstopa-splunk wrote a small app conf to replace the default index with unique name sometime back as an example , same can be customised and used.

block parser app-dest-rewrite-index() {
    channel {
        rewrite {
            r_set_splunk_dest_update_v2(
                index("${.splunk.index}_unique-suffix")
            );
        };
    };
};

application app-dest-rewrite-index[sc4s-postfilter] {
    parser { app-dest-rewrite-index(); };
};