Trouble with Host Extraction at Index Time

[JPrictoe]

To me this should be simple, but I can't get it. When entering host info while adding data I select "regex on path" and enter the regex for my capture group, but it still returns my default host upon search for that particular source. Even if I change my default host name in system/local or search/local inputs.conf, I still get my default host. Also if I select "segment on path" and just try to name it something along the path, I still get my default host. Even if my regex was not sound, some of these other options should work, where is Splunk continually pulling my default host from if I take it out of .conf files entirely?

[tiagofbmm]

To check where splunk is using your default host, use btool

$SPLUNK_HOME/bin/splunk btool inputs list --debug

It will show you the running configuration in your inputs and show you for the stanza you'rel looking for, where is it getting the default host from (where meaning from which conf file specifically)

[tiagofbmm]

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that