Eliminate Reserved Attributes

[pagbabian-splunk]

On a different note, as I alluded to in the #timestamps channel, there is an argument to do away with the Reserved attributes altogether. There are only three remaining: _time, _raw_data, _uid and there has already been some ambiguity as to what it means for a 'system' to populate them. For example if I'm a data producer 'system' I will be emitting _time as the time of the actual event (i.e. what would have been the ref_event for a mapper persona). The _raw_data is in fact the OCSF event itself, so implicitly it is also populated but would remain empty. Saying it is only reserved for a system no longer makes sense for the producer persona. More significantly though _uid could also be populated by a producer who assigns a unique ID to each event and again would be populated just like any other event. Hence, my suggestion is that rather than include this additional concept that seems to be a rule, we can do away with Reserved altogether and these three attributes can just be normal attributes.