How to change the value of host field when receiving some devices log from one host?

[sabaKhadivi]

if I received 20 devices log from a single syslog server , how can I seperate host field to those 20 source of logs instead of my syslog server IP address?

[richgalloway]

This is best done in your syslog server, rather than in Splunk. Have syslog save data in separate files based on the originating system. If you include the source address in the file path, a Splunk forwarder can use that as the host name. See https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html for more.

[jdsl]

To do it within Splunk, I think what you want to look at is this: https://docs.splunk.com/Documentation/Splunk/7.2.4/Data/Overridedefaulthostassignments