We have a couple of 7200 chassis with four VMs on each, arranged as four pairs of active/standby vcmp guests. I noticed today that in Splunk, the VMs are showing up (logging) using their host names, but both chassis are showing up as localhost. I've looked over the config and they only thing I've found different so far (comparing a VM to a chassis) is in the DNS setting for the VM it set with localhost and mydomain.com, whereas the chassis is just set with localhost. This is in System ›› Configuration : Device : DNS (DNS Search Domain List). I wouldn't think that would matter here, but I thought I would ask.
