Function handle_raw 

pub async fn handle_raw(
    __arg0: State<LogState>,
    __arg1: Query<SplunkRawQueryParams>,
    __arg2: Extension<QueryContext>,
    headers: HeaderMap,
    payload: Bytes,
) -> impl IntoResponse

POST /services/collector/raw (+ /raw/1.0 alias). By default, the whole body is raw text stored verbatim as ONE event in the RAW_MESSAGE_COLUMN — multiline payloads (e.g. stack traces) are preserved intact. Explicit framing is opt-in via ?linebreaker= (see split_raw_body). Metadata comes from query params and applies to every event. channel (param or x-splunk-request-channel header) is accepted but ignored until indexer acknowledgment lands;