There's a possibility the auto-generated sourcetype is doing that. I notice there are three "sourcetypes" in the picture you have, what are those two source types? It seems to me, from the info you provided, it seems like the data was fine when it was coming in under one sourcetype, then maybe switched to another sourcetype, which the host is set by a default sourcetype transform. ... View more