https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577392#M101987 <P>Answered this question myself.</P><P>The "extracted_host" is actually still "host" in the _meta key, so the solution is to force Splunk to read the _meta key for its value.</P><PRE>INGEST_EVAL = host:=$field:host$, $field:host$:=null()</PRE> Mon, 06 Dec 2021 05:00:33 GMT Brett 2021-12-06T05:00:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577391#M101986 <P>How can I get the "host" value extracted from a JSON event with "<SPAN>INDEXED_EXTRACTIONS = json" into the events host field?</SPAN></P><P>By default, this value ends up in the extracted_host value, and the following INGEST_EVAL does not work:</P><P><STRONG>INGEST_EVAL&nbsp;=&nbsp;host:=extracted_host,&nbsp;extracted_host:=null()&nbsp;</STRONG></P> Mon, 06 Dec 2021 04:59:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577391#M101986 Brett 2021-12-06T04:59:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577392#M101987 <P>Answered this question myself.</P><P>The "extracted_host" is actually still "host" in the _meta key, so the solution is to force Splunk to read the _meta key for its value.</P><PRE>INGEST_EVAL = host:=$field:host$, $field:host$:=null()</PRE> Mon, 06 Dec 2021 05:00:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-the-host-value-from-INDEXED-EXTRACTIONS-json/m-p/577392#M101987 Brett 2021-12-06T05:00:33Z