Function reorder_splunk_primary_keys 

fn reorder_splunk_primary_keys(primary_keys: &mut [String])

Moves Splunk’s metadata tags (host, source, sourcetype) to the front of the primary key, keeping the relative order of the remaining tags.