Normally the host is set at the initial forwarder receiving the data, not at a secondary forwarder or the indexer receiving the data on a splunktcp input. The connection_host setting only has an effect if the original forwarder did not set the host field.
Can you perhaps elaborate your situation a bit and why you are using this setting on a splunktcp input? Perhaps that can point us into directions to solve it 🙂
Hi Frank, are you sure that connection_host has no effect if the original forwarder set host field already?
Because I used to have connection_host= dns and I had a lot of DNS request by this intermediate forwarder even though all my original UF have got the host field set...