a lot has changed in the way you set up parsing addons since this was initially made. Back in Splunk 6.x normally you would see FIELDALIAS rules for all fields that the data provided to normalize it.
FIELDALIAS frequently causes problems now due to the new way it works, and NULLs overriding actual data is a problem if there is no source field matching the FIELDALIAS definition. Back in Splunk 6.x, you would not have this issue, as the lack of a source field (s_computername) would result in the FIELDALIAS getting skipped, and the host field you already had would still be there when you search.
On the other hand, overriding host for Splunk data on a forwarder is unneccessary in most cases, as the host field would already exist, it would make sense for the maintainer of this add-on to remove or disable this one in particular.
... View more
