Tanium is sending logs to our only syslog server and we have created a folder in that server (let us say a) so in Splunk cloud it should show as host = a, but in Splunk cloud, we could see hostname containing different syslog servers. Is it a bug?
It depends on how the data is being handled during index time. You can change the host field in index time with props/transforms confs and you can also set the host as a segment of the path your monitoring.
Several TAs bring some kind of field manipulation out of the box (e.g. you index data with source type pan_logs and it ends up as pan:traffic, pan:system, etc). Same logic can be applied to other fields in index time (e.g. index (for data routing), host (to correctly assign the host name), etc. )
------------ Hope I was able to help you. If so, an upvote would be appreciated.