hdf2splunk - reverse profile order for overlay HDFs

[ejaronne]

If at all possible, could the 3 profiles that are in the attached overlay sample go into Splunk in the order of: the bottom (baseline) goes in first, the middle next, and the top last? This will simplify my queries when trying to list fields such as profile name, putting the name for the top-level overlay at the top instead of the bottom (same for other fields in the profile schema). More importantly, I think it will swap the profiles to their original HDF order when using splunk2hdf.

While I understand that technically the json and data in Splunk is still correct, it makes it harder to prove parity for others if one needs to flip data during queries. example-3-layer-overlay_03062022.json.txt

Thanks!

May be related to #2775