Description of problem:

The splunk event host should be the origin hostname. but when payloadKey is defined, it is the splunk server address

How reproducible:

Always

Steps to Reproduce:

1. use payloadKey=.message in CLF

   apiVersion: observability.openshift.io/v1
   kind: ClusterLogForwarder
   metadata:
     name: collector
   spec:
     managementState: Managed
     outputs:
     - name: splunk-hec
       splunk:
         authentication:
           token:
             key: hecToken
             secretName: to-splunk-secret
         payloadKey: .message
         source: '{.log_source||.log_type||"logcollector"}'
         url: http://splunk-default-service.splunk-aosqe.svc:8088
       type: splunk
     pipelines:
     - inputRefs:
       - application
       name: pipe1
       outputRefs:
       - splunk-hec
     serviceAccount:
       name: logcollector
   
   

1. Check the host in event.

Actual results:

The host is splunk server address (splunk-default-service.splunk-aosqe.svc:8088)

  {
      "_bkt": "main~0~1571D407-55A0-48CF-B3DA-E1CD94DAF244",
      "_cd": "0:104798",
      "_indextime": "1748486775",
      "_raw": "{\"message\":\"ㄅㄉˇˋㄓˊ˙ㄚㄞㄢㄦㄆ 中国 883.317µs ā á ǎ à ō ó ▅ ▆ ▇ █ 々\"}",
      "_serial": "0",
      "_si": [
        "splunk-default-0",
        "main"
      ],
      "_sourcetype": "generic_single_line",
      "_time": "2025-05-29T02:46:15.000+00:00",
      "host": "splunk-default-service.splunk-aosqe.svc:8088",
      "index": "main",
      "linecount": "1",
      "source": "container",
      "sourcetype": "generic_single_line",
      "splunk_server": "splunk-default-0"
    }

Expected results:

The host is the origin hostname (ip-10-0-38-10.us-east-2.compute.internal )
{
"_bkt": "main~0~1571D407-55A0-48CF-B3DA-E1CD94DAF244",
"_cd": "0:106308",
"_indextime": "1748486894",
"_raw": "

",
"_serial": "0",
"_si": [
"splunk-default-0",
"main"
],
"_sourcetype": "generic_single_line",
"_subsecond": ".771",
"_time": "2025-05-29T02:48:13.771+00:00",
"host": "ip-10-0-38-10.us-east-2.compute.internal",
"index": "main",
"linecount": "1",
"source": "container",
"sourcetype": "generic_single_line",
"splunk_server": "splunk-default-0"
}