HI, I have my json message with 4-5 json key value pairs. I want to remove some of the fields and want to modify body before send it to splunk server. In OTEL Server i tried using file log receiver to modify body and transform log statements to set body. my json contians Body: Str({"instant":{"epochSecond":1747736470,"nanoOfSecond":616797000},"thread":"ListProc-Q0:I0","level":"DEBUG", "message":"{actual log message}}) My requirement is, i want to remove instant, thread, level fields and want to send "json value of message field, which comes dynamically" Updated body is getting printed in debug log, but still splunk server is showing original body as is. transform:\n log_statements:\n - context: log\n statements:\n \ - 'set(body, ParseJSON(body)[\"message\"])'\n - 'set(body, \"extracted\")'\n But my splunk server is showing it as is original body. Can some one please help me with this issue.
... View more
