Syslog server "host" field question

[adamblock2]

The Splunk documentation defines “host” as being “an event host value is typically the hostname, IP address, or fully qualified domain name of the network host from which the event originated.” In the case of a syslog server, is it best for the “host” field to contain the hostname of the syslog server, or could/should it contain the hostname of the host where the events are generated?

[woodcock]

The host field should absolutely be the place where the event occurred and not anything else in the delivery pipeline to splunk.

[somesoni2]

Syslog server will be an intermediate location between Splunk and actual server where events were generated. I would use the hostname of the server where events where generated (this should be logged within each event data itself) as host field, mostly using a transforms.conf to overwrite metadata field host.

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/overridedefaulthostassignments