Add the ability to specify the index when forwarding to splunk #61

[wagga40]

Update docs Update rules