if I received 20 devices log from a single syslog server , how can I seperate host field to those 20 source of logs instead of my syslog server IP address?
To do it within Splunk, I think what you want to look at is this: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments
This is best done in your syslog server, rather than in Splunk. Have syslog save data in separate files based on the originating system. If you include the source address in the file path, a Splunk forwarder can use that as the host name. See https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html for more.