Add support for configuring Splunk sourcetype in Custom Destinations

.generator/schemas/v2/openapi.yaml

@@ -17420,6 +17420,16 @@ components:
             Must have HTTPS scheme and forwarding back to Datadog is not allowed.
           example: https://example.com
           type: string
+        sourcetype:
+          description: |-
+            The Splunk sourcetype for the events sent to this Splunk destination.
+
+            If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype`
+            field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string
+            value is used as the sourcetype.
+          example: my-source
+          nullable: true
+          type: string
         type:
           $ref: "#/components/schemas/CustomDestinationForwardDestinationSplunkType"
       required:
@@ -17695,6 +17705,16 @@ components:
             Must have HTTPS scheme and forwarding back to Datadog is not allowed.
           example: https://example.com
           type: string
+        sourcetype:
+          description: |-
+            The Splunk sourcetype for the events sent to this Splunk destination.
+
+            If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype`
+            field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string
+            value is used as the sourcetype.
+          example: my-source
+          nullable: true
+          type: string
         type:
           $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationSplunkType"
       required:

cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_3048149063/frozen.json

@@ -0,0 +1 @@
+"2026-03-25T16:23:47.455Z"

cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-null-sourcetype-returns-OK-response_3048149063/recording.har

@@ -0,0 +1,109 @@
+{
+  "log": {
+    "_recordingName": "Logs Custom Destinations/Create a Splunk custom destination with a null sourcetype returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "896b2ffddef9ece3cfc55bf21df0cd79",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 263,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 592,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":null,\"type\":\"splunk_hec\"},\"name\":\"Nginx logs\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations"
+        },
+        "response": {
+          "bodySize": 360,
+          "content": {
+            "mimeType": "application/json",
+            "size": 360,
+            "text": "{\"data\":{\"id\":\"d328c779-9b3b-41c7-a952-20a7446eb7d1\",\"attributes\":{\"name\":\"Nginx logs\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":null},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 713,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-03-25T16:23:48.102Z",
+        "time": 518
+      },
+      {
+        "_id": "b0c9326a11bd84d51c31e1565da92ef4",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 0,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "*/*"
+            }
+          ],
+          "headersSize": 565,
+          "httpVersion": "HTTP/1.1",
+          "method": "DELETE",
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/d328c779-9b3b-41c7-a952-20a7446eb7d1"
+        },
+        "response": {
+          "bodySize": 0,
+          "content": {
+            "mimeType": "text/html; charset=utf-8",
+            "size": 0
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "text/html; charset=utf-8"
+            }
+          ],
+          "headersSize": 700,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 204,
+          "statusText": "No Content"
+        },
+        "startedDateTime": "2026-03-25T16:23:48.629Z",
+        "time": 374
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3331479502/frozen.json

@@ -0,0 +1 @@
+"2026-03-25T16:23:49.008Z"

cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-a-sourcetype-returns-OK-response_3331479502/recording.har

@@ -0,0 +1,109 @@
+{
+  "log": {
+    "_recordingName": "Logs Custom Destinations/Create a Splunk custom destination with a sourcetype returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "e40e6584080a0a976abbaac7f44042c6",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 274,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 592,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":\"my-sourcetype\",\"type\":\"splunk_hec\"},\"name\":\"Nginx logs\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations"
+        },
+        "response": {
+          "bodySize": 371,
+          "content": {
+            "mimeType": "application/json",
+            "size": 371,
+            "text": "{\"data\":{\"id\":\"429e154f-5cf5-41ce-ae15-4bc41563f46f\",\"attributes\":{\"name\":\"Nginx logs\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":\"my-sourcetype\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 713,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-03-25T16:23:49.010Z",
+        "time": 648
+      },
+      {
+        "_id": "6f5cc353eb8006ad8ba4a0b573ec4fe5",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 0,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "*/*"
+            }
+          ],
+          "headersSize": 566,
+          "httpVersion": "HTTP/1.1",
+          "method": "DELETE",
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/429e154f-5cf5-41ce-ae15-4bc41563f46f"
+        },
+        "response": {
+          "bodySize": 0,
+          "content": {
+            "mimeType": "text/html; charset=utf-8",
+            "size": 0
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "text/html; charset=utf-8"
+            }
+          ],
+          "headersSize": 700,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 204,
+          "statusText": "No Content"
+        },
+        "startedDateTime": "2026-03-25T16:23:49.664Z",
+        "time": 543
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-empty-string-sourcetype-returns-OK-response_3116751190/frozen.json

@@ -0,0 +1 @@
+"2026-03-25T16:23:50.210Z"

cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-empty-string-sourcetype-returns-OK-response_3116751190/recording.har

@@ -0,0 +1,109 @@
+{
+  "log": {
+    "_recordingName": "Logs Custom Destinations/Create a Splunk custom destination with an empty string sourcetype returns \"OK\" response",
+    "creator": {
+      "comment": "persister:fs",
+      "name": "Polly.JS",
+      "version": "6.0.5"
+    },
+    "entries": [
+      {
+        "_id": "8f9868734882068ec4ad8e924082c5d3",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 261,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "application/json"
+            },
+            {
+              "_fromType": "array",
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 592,
+          "httpVersion": "HTTP/1.1",
+          "method": "POST",
+          "postData": {
+            "mimeType": "application/json",
+            "params": [],
+            "text": "{\"data\":{\"attributes\":{\"enabled\":false,\"forward_tags\":false,\"forwarder_destination\":{\"access_token\":\"my-access-token\",\"endpoint\":\"https://example.com\",\"sourcetype\":\"\",\"type\":\"splunk_hec\"},\"name\":\"Nginx logs\",\"query\":\"source:nginx\"},\"type\":\"custom_destination\"}}"
+          },
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations"
+        },
+        "response": {
+          "bodySize": 358,
+          "content": {
+            "mimeType": "application/json",
+            "size": 358,
+            "text": "{\"data\":{\"id\":\"cb6c24f4-f420-42dd-bc86-ce51e03f7968\",\"attributes\":{\"name\":\"Nginx logs\",\"query\":\"source:nginx\",\"enabled\":false,\"forwarder_destination\":{\"endpoint\":\"https://example.com\",\"type\":\"splunk_hec\",\"sourcetype\":\"\"},\"forward_tags_restriction_list_type\":\"ALLOW_LIST\",\"forward_tags_restriction_list\":[],\"forward_tags\":false},\"type\":\"custom_destination\"}}\n"
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "application/json"
+            }
+          ],
+          "headersSize": 713,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 200,
+          "statusText": "OK"
+        },
+        "startedDateTime": "2026-03-25T16:23:50.213Z",
+        "time": 1034
+      },
+      {
+        "_id": "2868263b6837d9dc48b20187b7a96820",
+        "_order": 0,
+        "cache": {},
+        "request": {
+          "bodySize": 0,
+          "cookies": [],
+          "headers": [
+            {
+              "_fromType": "array",
+              "name": "accept",
+              "value": "*/*"
+            }
+          ],
+          "headersSize": 566,
+          "httpVersion": "HTTP/1.1",
+          "method": "DELETE",
+          "queryString": [],
+          "url": "https://api.datadoghq.com/api/v2/logs/config/custom-destinations/cb6c24f4-f420-42dd-bc86-ce51e03f7968"
+        },
+        "response": {
+          "bodySize": 0,
+          "content": {
+            "mimeType": "text/html; charset=utf-8",
+            "size": 0
+          },
+          "cookies": [],
+          "headers": [
+            {
+              "name": "content-type",
+              "value": "text/html; charset=utf-8"
+            }
+          ],
+          "headersSize": 699,
+          "httpVersion": "HTTP/1.1",
+          "redirectURL": "",
+          "status": 204,
+          "statusText": "No Content"
+        },
+        "startedDateTime": "2026-03-25T16:23:51.253Z",
+        "time": 510
+      }
+    ],
+    "pages": [],
+    "version": "1.2"
+  }
+}

cassettes/v2/Logs-Custom-Destinations_2771509030/Create-a-Splunk-custom-destination-with-an-invalid-sourcetype-returns-Bad-Request-response_668461555/frozen.json

@@ -0,0 +1 @@
+"2026-03-25T16:23:51.766Z"