add splunk attributes and rewind logstash conf template

for splunk integration...