Changing the field name of _to to something else since Splunk seems to
drop the leading underscore