Change: Fix splunk forwarder sketch

These changes make the splunk sketch enterprise compatible.
The inputs template has also been improved with regard to CFEngine log
files.

This also supersedes the splunk related changes in https://github.com/cfengine/design-center/pull/368/files