Validate Splunk index names before interpolating them into SPL queries and return 400 for invalid SIEM requests.