Is it possible to programatically set the sourcetype to be the namespace from where the logs were generated? I am using the fluentd plugin to send data to the Splunk http event collector. Elsewhere, it was recommended to use ${record['kubernetes']['namespace_name'] to set the index name to be the namespace name. When I do this for sourcetype, that actual text just shows up in Splunk rather than translating to the specific namespace names.

@include systemd.conf
@include kubernetes.conf

<match kubernetes.var.log.containers.fluentd**>
  type null
</match>

<match **>
  type splunk-http-eventcollector
  all_items true
  server host:port
  token ****
  index kubernetes
  protocol https
  verify false
  sourcetype ${record['kubernetes']['namespace_name']
  source kubernetes
  buffer_type memory
  buffer_queue_limit 16
  chunk_limit_size 8m
  buffer_chunk_limit 150k
  flush_interval 5s
</match>