I'm not clear on how to "provide host details", I currently have over 22k hosts sending data. Each BU contributes data from several hundred hosts. The goal is to provide each BU a breakdown of how much volume each BU generates. I only have host lists (csv) to work from. Unfortunately, I have no mechanism in Splunk (i.e. tags, or dedicated indexes) that associate hosts to a BU.