What is the best way to fix hostname for windows diskless clients?

[conner9]

We have a diskless windows infrastructure that has non-writable images. The splunk agent is installed in the image, and the hostname shows up for the diskless clients as $decideonstartup

Any suggestions for best way to get the proper hostname for the events, would be greatly appreciated.

Thanks

[mdsnmss]

Do you have a sample of events from these clients that you can provide? If the desired hostname can be found within the forwarded events they can be overridden and set as the event reach the indexer using props.conf and transforms.conf. https://docs.splunk.com/Documentation/Splunk/7.0.1/Data/Overridedefaulthostassignments