A city analyst searching Network_Traffic filters src to the edge firewall hostname and no client sessions appear. What was confused?
Select an answer to reveal the explanation.
Short Explanation
The firewall is the reporter, not the talker. dvc is the box that wrote the log; src is the client that started the session. Filter src as the firewall and you hide every clerk laptop.
Full Explanation
In Network_Traffic, dvc is the reporting device—the edge firewall sending the log—while src is the session initiator, typically the client on a municipal network. Filtering src to the edge firewall hostname therefore looks for sessions started by the firewall and hides normal client sessions the firewall merely reported. The city analyst confused the sensor with the initiator, a common Enterprise Security search mistake on perimeter data.
Claiming src is always the Splunk indexer that stored the event invents a meaning CIM does not use for Network_Traffic fields. Claiming dest is the firewall and dvc is the client laptop reverses reporting device and session endpoints and will mis-scope investigations. Claiming src and dvc are aliases so one hostname filter must match both erases a critical CIM distinction analysts rely on when writing portable searches.
Exam caveat: dvc means reporter; src and dest mean session endpoints. Mis-filtering src as the firewall is a classic SPLK-5001 trap.
Operational check: search Network_Traffic with dvc set to the firewall hostname and examine src and dest client addresses; do not put the firewall hostname in src unless investigating traffic originated by the firewall itself, such as management or VPN concentrator flows.