Metric pods are not setting a sourcetype

What happened:

Kubernetes Metrics pods do not set a sourcetype.

What you expected to happen:

We should be setting a sourcetype.

How to reproduce it (as minimally and precisely as possible):

deploy SCK metrics chart and examine metric payload

Anything else we need to know?:

This is likely best fixed in a rfull eview of field names we are senfing as the field names are not cleanly normalized to ensure they match across metric types

Environment:

• Kubernetes version (use kubectl version):

1.18

• Ruby version (use ruby --version):
• OS (e.g: cat /etc/os-release): Ubuntu 18.04
• Splunk version: 8.0.3
• Others: DSP 1.1 pictured above

[matthewmodestino]

Yeah I would keep in line with the other sourcetypes SCK sends which already use the “kube:container:foo” or “kube:objects:bar”.

This format is also inline with other Splunk addon sourcetype naming conventions.

[harshit-splunk]

@matthewmodestino Thanks for quick reply. Source will look like sck-splunk-kubernetes-metrics and sck-splunk-kubernetes-metrics-aggregator in splunk. kube:metrics or kube:metrics:agg is better option IMO Thanks.