UF (and splunk in generally) use host name of node. Some times this is a FQDN sometime only host part. It depends how it has set up on OS level. If you are not happy with it you can change it on UF's inputs.conf file as setting it in default stanza. See details here https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/SetadefaulthostforaSplunkserver
If you have several domain where you are collecting events it's usually good habit to have fqdn instead of host part only. You can always drop host part on queries if you don't like those and those are not needed (see e.g. rex mode=sed). Of course FQDN use little bit more license, but still...
