Fluentd sending to Splunk HEC: Want to set sourcetype to the namespace - kubernetes

Question

Is it possible to programatically set the sourcetype to be the namespace from where the logs were generated? I am using the fluentd plugin to send data to the Splunk http event collector. Elsewhere, it was recommended to use ${record['kubernetes']['namespace_name'] to set the index name to be the namespace name. When I do this for sourcetype, that actual text just shows up in Splunk rather than translating to the specific namespace names.
#include systemd.conf
#include kubernetes.conf
<match kubernetes.var.log.containers.fluentd**>
type null
</match>
<match **>
type splunk-http-eventcollector
all_items true
server host:port
token ****
index kubernetes
protocol https
verify false
sourcetype ${record['kubernetes']['namespace_name']
source kubernetes
buffer_type memory
buffer_queue_limit 16
chunk_limit_size 8m
buffer_chunk_limit 150k
flush_interval 5s
</match>

Answer 1

If you have not defined a sourcetype in an appropriate props.conf (and associated transforms.conf), Splunk will try to determine the sourcetype based on heuristics
Those heuristics are not generally very accurate on custom data sources
Instead of trying to "programatically set the sourcetype to be the namespace from where the logs were generated", add a field whose contents indicate the namespace from which the logs are generated (eg "namespace")
It's much simpler, extends your logging more efficiently, and doesn't require the definition of scores or hundreds or thousands of individual sourcetypes