How do I change the field names which are shown up i splunk

[saiharshitachava]

How do I change the field names which are shown up in splunk

I want to have custom field names like I want to rename k8s.cluster.name to cluster_name so that I can match earlier splunk connect configs How can I do that using otel

[matthewmodestino]

You can use the renameFieldsSck setting, set to true to have the collector send field names that were used in SCK

splunk-otel-collector-chart/helm-charts/splunk-otel-collector/values.yaml

Lines 72 to 76 in 75cfd0b

	fieldNameConvention:
	# Boolean for renaming pod metadata fields to match to Splunk Connect for Kubernetes helm chart.
	renameFieldsSck: false
	# Boolean for keeping Otel convention fields after renaming it
	keepOtelConvention: true

[saiharshitachava]

keepOtelConvention: true
this also should be true @matthewmodestino ? I used below values

 fieldNameConvention: 
   ## Boolean for renaming pod metadata fields to match to Splunk Connect for Kubernetes helm chart. 
   renameFieldsSck: true
   ## Boolean for keeping Otel convention fields after renaming it 
   ## keepOtelConvention: true 

Cause I tried this and I see changes in config map as below but still I dont see the fields reflecting in splunk
resource/logs:
attributes:
- action: upsert
from_attribute: k8s.pod.annotations.splunk.com/sourcetype
key: com.splunk.sourcetype
- action: delete
key: k8s.pod.annotations.splunk.com/sourcetype
- action: delete
key: splunk.com/exclude
- action: upsert
from_attribute: k8s.container.name
key: container_name
- action: upsert
from_attribute: k8s.cluster.name
key: cluster_name
- action: upsert
from_attribute: container.id
key: container_id
- action: upsert
from_attribute: k8s.pod.name
key: pod
- action: upsert
from_attribute: k8s.pod.uid
key: pod_uid
- action: upsert
from_attribute: k8s.namespace.name
key: namespace

[matthewmodestino]

If you would like to keep the fields OTel provides you can set it to true and you get both, as far as I know.