make field names splunk-friendly