This could be an order of operations issue with respect to when the value of "host" is being set. Out of curiousity are you using Splunk forwarders? If "host" is also being set via index-time TRANSFORMS property (which is often the case for direct syslog input), you may have to specify your TRANSFORMS to run on your source input and specify the values of "host" in the REGEX.
For instance:
## props.conf
[source::udp:514]
TRANSFORMS-routing_for_syslog = InfoSecRouting_syslog
## transforms.conf
[InfoSecRouting_syslog]
REGEX = \w{3}\s+\d+\s+\d{2}:\d{2}\d{2}\s+(host1.xxxxxxx.xxx|host2.xxxxxxx.xxx)
DEST_KEY=_TCP_ROUTING
FORMAT=InfoSecGroup
## For reference this is the $SPLUNK_HOME/etc/system/default/transforms.conf for syslog-host
[syslog-host]
DEST_KEY = MetaData:Host
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(\w[\w\.\-]{2,})\]?\s
FORMAT = host::$1
... View more