SplunkPy: use expandtoken in mirroring query

[ilappe]

Related Issues

fixes: https://jira-dc.paloaltonetworks.com/browse/XSUP-37814

Description

use the expandtoken in the mirror in query in order to avoid overriding the fields by the "non expanded tokens "

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
Packs/SplunkPy/Integrations/SplunkPy
SplunkPy.py	1454	397	72%	114–115, 153, 155, 180–181, 185–188, 190–191, 195–198, 221, 232, 306, 310–312, 315–318, 345–347, 357, 491, 493, 606–607, 613, 634, 653–655, 657, 728–729, 742–747, 768–769, 771–773, 775, 777, 853–858, 860, 864–865, 1094–1095, 1097, 1116–1117, 1152–1161, 1196–1197, 1199, 1217, 1264–1265, 1267, 1272–1273, 1279, 1282–1283, 1315–1317, 1325, 1387–1389, 1391–1392, 1454, 1486, 1540–1541, 1607, 1638–1640, 1642, 1667–1668, 1672, 1675, 1678–1686, 1689–1690, 1692, 1694–1695, 1725–1727, 1729, 1731–1732, 1734–1738, 1740–1742, 1744, 1752, 1754–1757, 1761–1769, 1771–1772, 1940, 1943, 1946, 1949, 1952–1955, 1957, 1961–1964, 1967, 1969–1974, 1976, 2102, 2130, 2134, 2143, 2153, 2157, 2178, 2180, 2182, 2184, 2204, 2207, 2212–2216, 2224, 2226–2228, 2270, 2298, 2346, 2352, 2356–2361, 2363–2365, 2367–2368, 2370, 2372–2374, 2408, 2416–2418, 2420–2421, 2423, 2434, 2441–2445, 2449, 2451, 2459–2467, 2469, 2471–2474, 2476–2477, 2508–2513, 2521–2524, 2527–2530, 2545–2546, 2548–2553, 2555, 2565, 2569–2570, 2572, 2584, 2605, 2620, 2632, 2639–2641, 2643–2644, 2661–2663, 2686, 2693–2697, 2703–2704, 2712–2713, 2729–2733, 2736, 2738, 2744–2751, 2753–2754, 2756–2757, 2763–2771, 2773–2774, 2780–2781, 2787–2788, 2790–2792, 2794, 2799–2806, 2808, 2813, 2820–2823, 2832–2835, 2839–2842, 2857, 2859–2860, 2862–2863, 2865, 2874, 2878–2885, 2890, 2906–2907, 2914–2917, 2945–2952, 2956–2957, 2959–2964
TOTAL	1454	397	72%

Tests	Skipped	Failures	Errors	Time
192	0 💤	0 ❌	0 🔥	2.828s ⏱️