[splunk/alert] - Keep non-numeric proto as ECS field network.transport

[ShourieG]

Type of change

• Bug

Proposed commit message

splunk/alert: keep non-numeric proto as network.transport

The convert_proto_to_long processor forced splunk.alert.proto to a
long. Palo Alto Networks and other CEF sources send a transport name
such as "tcp" in this field, so the conversion failed, appended to
error.message, tagged the event as pipeline_error, and dropped the
value.

Handle the non-numeric case instead of failing: copy the value to ECS
network.transport (lowercased) and remove splunk.alert.proto without
recording an error. Numeric values still convert to long, so the field
mapping is unchanged and the fix is not a breaking change.

Add a synthetic pipeline regression test covering both a protocol name
and a numeric protocol number.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
packages/splunk/changelog.yml	4	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[vera-review-bot]

No issues across the latest commits ce3898c.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[efd6]

Is it worth doing an IANA protocol number look-up if the convert succeeds? This would bring parity to the two forms.

[ShourieG]

But this would mean we would need a reverse lookup when convert fails right ?

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: ce3898c

cc @ShourieG