f5:bigip:syslog sourcetype falls back to nix:syslog when line starts with -c

[PashFW]

due to the known bug of f5 ...
Bug ID 1057305: On deployments that use DPDK, "-c" may be logged as the TMM process/thread name.
cdn.f5.com/product/bugtracker/ID1057305.html

...some syslog lines may start with "-c[123]" instead of the expected common "tmm[123]", which causes sc4s to mark these structurally valid lines as nix:syslog, causing incorrect further parsing in splunk

probably it makes sense to add a workaround by pattern like ^-c\[\d+\] to avoid transforms on the splunk end

example of normal line
tmm1[10801]: Rule /Common/http_log <HTTP_RESPONSE>: 22:20:48 | Client IP: 137.86.211.3 | HTTP Request Method: GET | HOSTNAME: mbcu-rm.example.com | URL: /api/order/creative_actions | Response Code: 200 | Cookie:

example of mismatched line
-c[10801]: Rule /Common/ops207709_api_irule <HTTP_RESPONSE>: 22:20:48 | Client IP: 34.219.299.167 | HTTP Request Method: GET | HOSTNAME: api.example.com | URL: /services/v4/programmatic/deals/110209 | Response Code: 200 | Cookie: