Because host is one of the few indexed fields, rather than search-time fields, you will have to do things a little differently. You should not use the Interactive Field Extractor or any other search-time method for creating the host field.
In props.conf, put
[yoursourcetype] SHOULD_LINEMERGE=false TIME_PREFIX=Time: TIME_FORMAT = %y%m%d %H:%M:%S TRANSFORMS-my-host = extract-my-host
In transforms.conf, put
[extract-my-host] DEST_KEY = MetaData:Host REGEX = ^\[(\S+?)] FORMAT = host::$1
I don't know what sourcetype you gave this data, but you will need to substitute that for
yoursourcetype in props.conf. I also threw in a few more settings that will speed up Splunk's parsing of the input stream, and make sure the timestamp is properly interpreted. I assume that this log contains only single-line events.
Also, the REGEX assumes that the host name always appears at the beginning of each line, enclosed in square brackets.
Let us know if that doesn't work.
You can tell Splunk to extract the field with the interactive field extractor, doc here:
To combine the events, you'll have to use the transaction function within Splunk during a search. Here:
is a Splunk blog describing how to achieve this. Let us know if this is not what you are looking for.