A default field that contains the host name or IP address of the network device that generated an event. Each event has a host field. The indexer generates the host field at index time. You use the host field in searches to narrow the search results to events that originate from a specific device.
You can configure host values for events when events are input into Splunk Enterprise. You can set a default host for a Splunk Enterprise server, file, or directory input. You can also have Splunk Enterprise assign host values to events based on data in those events.
In Knowledge Manager Manual:
In Getting Data In: