CDP sending data to splunk reducing complexity

Problem: 
CDP sends our JSON log lines as part of a message field/value to Splunk. In this process the Json gets stringified \”key\”: \”value\”. 
Splunk cannot extract this string by default like it does when sending the logs via the by Splunk recommended/default way. 

So, we as a consumer cannot really use the logs that CDP sends to Splunk without a lot of work on Splunk side like custom field extraction, config changes, …  
Also, a lot of companies have centralized Splunk teams, where the app teams only have limited configuration options in their Splunk.

Source log format
{“logKey1”:”logValue1”, …}

As-Is Logs/Events in Splunk via CDP
Message=”{\“logKey1\”:\”logValue1\”, …}”

Expected format in Splunk

{“logKey1”:”logValue1”, …}

Possible Solution:
For Json logs and possibly all logs send the log lines as part of an event field like recommended. Do not stringify them.

Example with curl: curl "scribe.uat” -d '{"event": {"logKey1": "logValue1", …}}' 
Example explicit for JSON : curl "scribe.uat” -d '{"sourcetype": "_json", "event": {"loglevel": "INFO", "example": "value": }}' 
https://help.splunk.com/en/data-management/collect-http-event-data/use-hec-in-splunk-enterprise/http-event-collector-examples#:~:text=%27%7B%22acks%22%3A%20%5B1%2C3%2C4%5D%7D%27-,Example%208%3A%20Extract%20JSON%20fields,-This%20example%20demonstrates


As probably many consumers already receive their mainframe logs via CDP in the old format via message it would be a good idea to add an additional field to CDP like “Splunk HEC for JSON logs”. 

Another less important, but nevertheless open point is whether to send the metadata also as JSON or like currently (host=mainframe). 
Maybe this could be made configurable so that the consumer can choose this on CDP side.