How do you add for non-standard splunk fields? For example, when using extraVolumes, extraVolumeMount and extraFilesLogs, the usual K8S metadata is log, so there's no way to determine which namespace, pod, etc... its coming in from the default config for audit is a perfect example, how do extraFileLogs:
filelog/audit-log:
include: [/var/log/audit/audit.log]
start_at: beginning
include_file_path: true
include_file_name: true
resource:
com.splunk.source: /var/log/audit/audit.log
host.name: 'EXPR(env("K8S_NODE_NAME"))'
com.splunk.sourcetype: kube:apiserver-audit
... View more