A suspect IP is talking to civic hosts in Network_Traffic. The analyst needs the most recent dest that src reached, without building a full transaction. What should they use?
Select an answer to reveal the explanation.
Short Explanation
There is no need for the whole phone bill to see who that IP called last. last(dest) per src is that last number on the civic Network_Traffic log. Skip the full transaction when one latest value is the question.
Full Explanation
last() returns the most recent value of a field inside a group. Applied as last(dest) by src on Network_Traffic, it answers which civic host a suspect IP talked to most recently. A full transaction is unnecessary for that single latest value. Analysts should use last() on the CIM field rather than rebuilding dest from _raw.