How to get the host value from INDEXED_EXTRACTIONS = json

[Brett]

How can I get the "host" value extracted from a JSON event with "INDEXED_EXTRACTIONS = json" into the events host field?

By default, this value ends up in the extracted_host value, and the following INGEST_EVAL does not work:

INGEST_EVAL = host:=extracted_host, extracted_host:=null() 

[Brett · Accepted solution]

Answered this question myself.

The "extracted_host" is actually still "host" in the _meta key, so the solution is to force Splunk to read the _meta key for its value.

INGEST_EVAL = host:=$field:host$, $field:host$:=null()