Add decoding for downtime external commands
Merge branch 'wcooley/issue_13' into decode-ext-command

* wcooley/issue_13:
  Match either following ";" or end of line
Rename "duration" field to "sched_duration".

"Duration" is a field added by the "transaction" command.
Replace eventtype downtime extraction & fix svc

This commit replaces the eventtype-based extraction of fields in
downtime-scheduling commands with a regular sourcetype-based regex
extraction.

Extracting fields in props based on eventtypes is a deprecated practice
and possibly caused some minor server-wide performance degradation:

http://splunk-base.splunk.com/answers/6524/extracting-fields-based-on-eventtype
http://splunk-base.splunk.com/answers/4217/performance-considerations-for-eventtypes

Delimiter-based extraction seems cleaner than regex, but due to the fact
that external commands all have different formats, it is not possible to
use in this case. To use DELIMS effectively would require making
sourcetype dynamic, based on the event pattern, which might not be a bad
idea anyway, although it has performance implications and would be a
major change.

I also noticed that SCHEDULE_SVC_DOWNTIME has a slightly different
format from all of the other SCHEDULE_*_DOWNTIME commands, so this
change also handles that.

Finally, I also add the field "downtime_type"; I had to match the text
between "SCHEDULE_" and "_DOWNTIME" anyway, so adding another field is
basically free.
Merge branch 'wcooley-wcooley/extract-sched-downtime-cmd' into dela-3.0.0-rc