Splunk 7.0.2 Universal forwarder running on a linux box splunk2.lab.local This is sending a monitor /var/log to a search at splunk.lab.local Events are showing up as host splunk2.lab.local except for source type syslog which is coming in as just splunk2 I would like to normalize this so both hosts are splunk2.lab.local . I see in props.conf on the search box: [syslog] TRANSFORM = syslog-host I tried just making that: [syslog] TRANSFORM = What is the best way to handle this? Should I do something on the linux host that will make it log its hostname in syslog as FQDN? Is there a way to handle it where maybe I can setup an alias or similar so that two values can be merged? ... View more