From my experience you can share the same name between props stanzas without issue. However what I would ask is what is the name of the Splunk server? Your override is designed to change the host metadata field that is indexed. Your transform however is trying to override it after it appears to be defined. I would try to apply the host transform to the source (so instead of host:: do a source:) so that the transform is applied as early on as possible. ... View more

The field on the TO event is named slightly different so you can do something like this "| eval Correlation_Id=coalesce(Correlation_Id,event_id) | transaction Correlation_ID" ... View more