When must a host value be explicitly set in inputs.conf for a TCP input?

The host value must be explicitly set in inputs.conf for a TCP input when the connection_host is configured to custom or none. This is because the connection_host determines how Splunk identifies the source host for incoming data.

In the case where the connection_host is set to custom or none, Splunk does not automatically derive the host value from the incoming data source, such as the IP address. Instead, it relies on the user to specify the host explicitly to ensure that the data is accurately tagged with the appropriate host information. This explicit assignment helps maintain data integrity and organization, especially when there are multiple sources feeding into the same instance.

Other choices may suggest scenarios where setting the host value is beneficial, but they do not address the specific requirement outlined in the question, which directly relates to the configuration of connection_host. For example, the use of IPv4 addresses, adding multiple network inputs, or defining port ranges does not inherently relate to the necessity of setting the host explicitly in the context of connection_host settings.