fn raw_metadata(params: &SplunkRawQueryParams) -> Vec<(&'static str, Bytes)>Expand description
Collects request-level /raw metadata (host/source/sourcetype) present in
the query params. The keys double as the tag-column names; values apply to every
event in the request (HEC /raw metadata is request-level, unlike /event).