A city analyst searching Network_Traffic filters src to the edge firewall hostname and no client sessions appear. What was confused?
Select an answer to reveal the explanation.
Short Explanation
The firewall is the reporter, not the talker. dvc is the box that wrote the log; src is the client that started the session. Filter src as the firewall and you hide every clerk laptop.
Full Explanation
In CIM Network_Traffic, dvc is the reporting device, typically the firewall or sensor, and src is the initiator of the session. Filtering src as the firewall hostname therefore misses the client. dest is the target, not the sensor, and src is not the Splunk indexer. Distinguishing reporting device from session source is a required investigation-field skill.