/opt/splunk/etc/bundles/local/transforms.conf

[hostfix]
DEST_KEY = MetaData:Host
REGEX = ^\S+\s+(\S+)
FORMAT = host::$1

/opt/splunk/etc/bundles/local/props.conf

[source::/var/log/buffers/*]
TRANSFORMS-host=hostfix
SHOULD_LINEMERGE = false