<p>Is it possible to programatically set the sourcetype to be the namespace from where the logs were generated?  I am using the fluentd plugin to send data to the Splunk http event collector.  Elsewhere, it was recommended to use ${record['kubernetes']['namespace_name'] to set the index name to be the namespace name.  When I do this for sourcetype, that actual text just shows up in Splunk rather than translating to the specific namespace names.</p>

<pre><code>@include systemd.conf
@include kubernetes.conf

&lt;match kubernetes.var.log.containers.fluentd**&gt;
  type null
&lt;/match&gt;

&lt;match **&gt;
  type splunk-http-eventcollector
  all_items true
  server host:port
  token ****
  index kubernetes
  protocol https
  verify false
  sourcetype ${record['kubernetes']['namespace_name']
  source kubernetes
  buffer_type memory
  buffer_queue_limit 16
  chunk_limit_size 8m
  buffer_chunk_limit 150k
  flush_interval 5s
&lt;/match&gt;
</code></pre>

trouphaz
<p>If you have not defined a <code>sourcetype</code> in an appropriate <code>props.conf</code> (and associated <code>transforms.conf</code>), Splunk will try to determine the sourcetype based on heuristics</p>
<p>Those heuristics are not generally very accurate on custom data sources</p>
<p>Instead of trying to &quot;programatically set the sourcetype to be the namespace from where the logs were generated&quot;, add a field whose contents indicate the namespace from which the logs are generated (eg &quot;namespace&quot;)</p>
<p>It's much simpler, extends your logging more efficiently, and doesn't require the definition of scores or hundreds or thousands of individual sourcetypes</p>
