I am also experiencing this exact set of symptoms. I have seen it happen with many different custom sourcetypes, so I do not think it is related to any manipulation of the syslog sourcetype that splunk does. Does anyone have an explanation for this? ... View more

I've got the same problem, anybody have an answer for this? ... View more

I have exactly the same problem, does anyone know of a way around this? It appears from the docs that you can only manually override the host for inputs that are monitoring files or directories, but I need some way of setting the host to the local machine name for UDP/TCP inputs. (Localhost/127.0.0.1 are not very useful!) ... View more