Can I prevent the default index-time extraction for the "host" field to occur for events of the "syslog" sourcetype?

The value of the "host" field for events of the "syslog" sourcetype is extracted using the "syslog-host" transform.

The transform is called in $SPLUNK_HOME/etc/system/default/props.conf :

[syslog]
pulldown_type = true 
maxDist = 3
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
TRANSFORMS = syslog-host
REPORT-syslog = syslog-extractions
SHOULD_LINEMERGE = False

The index-time filed extraction transform is defined $SPLUNK_HOME/etc/system/default/transforms.conf.

The easiest way to prevent that extraction from happening is to suppress the call of the transform by populating the $SPLUNK_HOME/etc/system/local/props.conf file in the following way :

[syslog]
TRANSFORMS = 

This will result in the following effective configuration stanza for props.conf, which shows we have overwritten the TRANSFORMS used for the "syslog" sourcetype :

# $SPLUNK_HOME/bin/splunk cmd btool props list syslog --debug
system [syslog]
system BREAK_ONLY_BEFORE =
system BREAK_ONLY_BEFORE_DATE = True
system CHARSET = UTF-8
system DATETIME_CONFIG = /etc/datetime.xml
(...)
system TIME_FORMAT = %b %d %H:%M:%S
system TRANSFORMS =
system TRUNCATE = 10000
system maxDist = 3
system pulldown_type = true

After a restart of Splunk, the indexer will use the source ip/hostname of the forwarder that sent that data to populate the "host" field.