splunk: fix incorrect dst_ref.value mapping [#919]

[pcoccoli]

Closes #919

[codecov]

Codecov Report

Merging #970 (ffa8d14) into develop (d6d47f0) will increase coverage by 0.78%.
The diff coverage is 100.00%.

@@             Coverage Diff             @@
##           develop     #970      +/-   ##
===========================================
+ Coverage    65.24%   66.02%   +0.78%     
===========================================
  Files          517      517              
  Lines        48452    47885     -567     
===========================================
+ Hits         31612    31617       +5     
+ Misses       16840    16268     -572     

Impacted Files	Coverage Δ
.../tests/stix_translation/test_splunk_stix_to_spl.py	86.93% <100.00%> (+12.59%)	⬆️
...ter_utils/stix_transmission/utils/RestApiClient.py	53.29% <0.00%> (-4.10%)	⬇️
...les/paloalto/stix_translation/query_constructor.py	77.74% <0.00%> (-3.23%)	⬇️
...odules/crowdstrike/stix_transmission/api_client.py	47.88% <0.00%> (-1.39%)	⬇️
.../sentinelone/stix_translation/query_constructor.py	63.03% <0.00%> (-1.37%)	⬇️
...es/darktrace/stix_translation/query_constructor.py	78.60% <0.00%> (-0.66%)	⬇️
...bm_security_verify/stix_transmission/api_client.py	16.79% <0.00%> (-0.27%)	⬇️
...s/cybereason/stix_translation/query_constructor.py	76.29% <0.00%> (-0.25%)	⬇️
...odules/elastic_ecs/stix_transmission/api_client.py	13.75% <0.00%> (+0.16%)	⬆️
...urity_verify/stix_translation/query_constructor.py	42.80% <0.00%> (+0.29%)	⬆️
... and 31 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d6d47f0...ffa8d14. Read the comment docs.