splunkPlatform.fieldNameConvention.renameFieldsSck doesn't cover journald units or extraFileLogs

[vinzent]

According to the SCK migration guide, it's possible to preserve the Splunk field names as used with SCK. Without this, we would need to rework all our custom Splunk Dashboards.

splunk-otel-collector-chart/docs/migration-from-sck.md

Lines 405 to 414 in ff1e1ff

	If you wish to continue using Splunk Connect for Kubernetes's naming convention, you can use the following configuration:
	```yaml
	splunkPlatform:
	fieldNameConvention:
	# Boolean for renaming pod metadata fields to match to Splunk Connect for Kubernetes helm chart.
	renameFieldsSck: true
	# Boolean for keeping Otel convention fields after renaming it
	keepOtelConvention: false
	```

Now I discovered that the setting only affects the logs pipeline but not the logs/host. The resource/logs is not included in the logs/host pipeline.

splunk-otel-collector-chart/helm-charts/splunk-otel-collector/templates/config/_otel-agent.tpl

Line 678 in ff1e1ff

logs/host:

Probably for journald and extraFileLogs only the cluster_name field is relevant.

splunk-otel-collector-chart/helm-charts/splunk-otel-collector/templates/config/_common.tpl

Lines 121 to 123 in ff1e1ff

	- key: cluster_name
	from_attribute: k8s.cluster.name
	action: upsert

[matthewmodestino]

I don't believe SCK really set any major fields for those sources...do you have examples of said fields?
Most of them would have been custom or from fluentd specific input implementations, and can likely be set in otel inputs anyways...

Also while i understand it makes cutting over easy, SCK wasn't exactly thinking long term about fields and formats, whereas OTel formats will be with us for the foreseeable future and beyond. In many cases it also has much better fields/info. so I'd caution staying married to anything SCK for the long term anyways....

would be interested to see what fields you are talking about as the sck config doesnt exactly do anything special with those sources that you can't do today in otel configs.

[vinzent]

I think only cluster_name is missing for extraLogsFiles. At least this is a field i'm using in dashboards for openshift audit logs to disinct the different clusters. Haven't checked if k8s.cluster.name is available.

I personally don't mind if SCK fields go away. Problem is once we upgrade and don't have SCK fields available, any splunk dashboard built by appdevs will immediately stop working. I think we need to give them some time to transition to the new fields. They need to exist so they can "see them" and adjust their config.

[matthewmodestino]

Ah yes, will check the pipeline that gets made for extraFilelogs, I was playing with this backward compatibility feature recently. Worst case I should be able to see what needs to be added to the filelog and journald pipeline to add it.