diff --git a/.generator/schemas/v2/openapi.yaml b/.generator/schemas/v2/openapi.yaml
index 3ac7ae5f2b73..3f3cccacc2ad 100644
--- a/.generator/schemas/v2/openapi.yaml
+++ b/.generator/schemas/v2/openapi.yaml
@@ -18679,9 +18679,10 @@ components:
           description: |-
             The Splunk sourcetype for the events sent to this Splunk destination.
 
-            If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype`
-            field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string
-            value is used as the sourcetype.
+            If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype `_json` is used.
+            On update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.
+            If set to `null`, the sourcetype field is omitted from the forwarded event entirely.
+            Otherwise, the provided string value is used as the sourcetype.
           example: my-source
           nullable: true
           type: string
@@ -18964,9 +18965,10 @@ components:
           description: |-
             The Splunk sourcetype for the events sent to this Splunk destination.
 
-            If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype`
-            field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string
-            value is used as the sourcetype.
+            If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype `_json` is used.
+            On update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.
+            If set to `null`, the sourcetype field is omitted from the forwarded event entirely.
+            Otherwise, the provided string value is used as the sourcetype.
           example: my-source
           nullable: true
           type: string
diff --git a/services/logs_custom_destinations/src/v2/models/CustomDestinationForwardDestinationSplunk.ts b/services/logs_custom_destinations/src/v2/models/CustomDestinationForwardDestinationSplunk.ts
index fabca8b508f5..9d0f755cb562 100644
--- a/services/logs_custom_destinations/src/v2/models/CustomDestinationForwardDestinationSplunk.ts
+++ b/services/logs_custom_destinations/src/v2/models/CustomDestinationForwardDestinationSplunk.ts
@@ -18,9 +18,10 @@ export class CustomDestinationForwardDestinationSplunk {
   /**
    * The Splunk sourcetype for the events sent to this Splunk destination.
    *
-   * If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype`
-   * field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string
-   * value is used as the sourcetype.
+   * If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype `_json` is used.
+   * On update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.
+   * If set to `null`, the sourcetype field is omitted from the forwarded event entirely.
+   * Otherwise, the provided string value is used as the sourcetype.
    */
   "sourcetype"?: string;
   /**
diff --git a/services/logs_custom_destinations/src/v2/models/CustomDestinationResponseForwardDestinationSplunk.ts b/services/logs_custom_destinations/src/v2/models/CustomDestinationResponseForwardDestinationSplunk.ts
index a5fe1564edda..23c466f540d4 100644
--- a/services/logs_custom_destinations/src/v2/models/CustomDestinationResponseForwardDestinationSplunk.ts
+++ b/services/logs_custom_destinations/src/v2/models/CustomDestinationResponseForwardDestinationSplunk.ts
@@ -14,9 +14,10 @@ export class CustomDestinationResponseForwardDestinationSplunk {
   /**
    * The Splunk sourcetype for the events sent to this Splunk destination.
    *
-   * If absent, the default sourcetype `_json` is used. If set to null, the `sourcetype`
-   * field is omitted from the Splunk HEC payload entirely. Otherwise, the provided string
-   * value is used as the sourcetype.
+   * If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype `_json` is used.
+   * On update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept.
+   * If set to `null`, the sourcetype field is omitted from the forwarded event entirely.
+   * Otherwise, the provided string value is used as the sourcetype.
    */
   "sourcetype"?: string;
   /**