Rather, the Device IP or Device Host value is determined by examining the NetWitness Log Collector Windows Eventing host configuration.
If the Host's Event Source Address is configured with an IP address, then the IP address value is populated under the Device IP (device.ip) meta key.

If the Host's Event Source Address is configured with a hostname or FQDN, then that value is populated under the Device Host (device.host) meta key.
