My guess is that your props.conf stanza isn't referencing the right thing, or your timestamp settings are too late. Check out and follow along with the community wiki on how indexing works. You're using an rsyslog server to send over tcp to Splunk. In this setup Splunk is likely assigning the host by applying a regular expression to the event at index time and extracting it (this is typically done for syslog, and might even be a default extraction for your sourcetype) ... this would happen during the Typing pipeline step. Timestamp extraction however has already happened during the Merging pipeline, therefore your props.conf settings referring to the host from the event is not being picked up (as the host you're referencing is set too late). You probably want to apply the settings referencing the host as the syslog server (or whatever is being set depending on connection_host in inputs.conf ) Or referencing the sourcetype you're using for the data. ... View more