We are attempting to configure our Kubernetes cluster with the splunk connect for kubernetes plugin (https://github.com/splunk/splunk-connect-for-kubernetes). We see events being sent to the indexer and everything is working as expected.

The splunk connect configuration by default either configures the sourcetype of events as kube:container:[container-name] or you can override the sourcetype using k8s annotations. Our one pod has logs created by log4j, so we'd like to use this sourcetype. When we attempt to configure the annotation on the pod as splunk.com/sourcetype = log4j, it changes the sourcetype to kube:log4j which is expected based on the documentation. We want to be able to have the event automatically formatted using the log4j pretrained sourcetype, though.

Is there a way to map a custom sourcetype in splunk like kube:container:[container-name] to format as log4j automatically? Is our only option to modify the fluentd filter configuration within the splunk connect configmap?