log different field based on sourcetype

[John_Zheng]

Hi, I am using splunk otel,  send log to splunk enterprise.For different sourcetype, I want to do different thing, like add field, remove fields

can you guide me, thanks a lot.

For below, it work.

```
      transform/istio-proxy:
        error_mode: ignore
        log_statements:
        - context: log
          statements:
          - set(attributes["johnaddkey"], "johnaddvalue")

```

For below, it does not work.

```
      transform/istio-proxy:
        error_mode: ignore
        log_statements:
        - context: log
          statements:
          - set(attributes["johntestwhere"], "johnvaluewhere") where attributes["sourcetype"]
            == "kube:container:istio-proxy"

```

For below, it does not work.

```
      transform/istio-proxy:
        error_mode: ignore
        log_statements:
        - context: log
          conditions:
          - attributes["sourcetype"] == "kube:container:istio-proxy"
          statements:
          - set(attributes["johnaddkeyc"], "johnaddvaluec") 

```

[John_Zheng · Accepted solution]

Ok, finically I figured out by myself.

Here is correct code

```

transform/istio-proxy:
error_mode: ignore
log_statements:
- context: log
statements:
- keep_keys(resource.attributes, ["_time", "cluster_codename", "host.name", "com.splunk.index", "splunk_server", "com.splunk.source", "com.splunk.sourcetype"]) where resource.attributes["com.splunk.sourcetype"]
== "kube:container:istio-proxy"
- delete_key(attributes, "logtag") where resource.attributes["com.splunk.sourcetype"]
== "kube:container:istio-proxy"

``` 

The point is should use resource.attributes["com.splunk.sourcetype"]

instead of  attributes["sourcetype"]