Get dest host and realm the correct way around on SAS logs