A suspect IP is talking to civic hosts in Network_Traffic. The analyst needs the most recent dest that src reached, without building a full transaction. What should they use?
Select an answer to reveal the explanation.
Short Explanation
There is no need for the whole phone bill to see who that IP called last. last(dest) per src is that last number on the civic Network_Traffic log. Skip the full transaction when one latest value is the question.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, last() returns the most recent value of a field inside a group without requiring a full multi-event transaction. Applying last(dest) per src on Network_Traffic answers which civic host a suspect IP talked to most recently—enough for many triage questions without retaining every historical dest. Using transaction with no maxspan so every historical dest is retained fails by concept because an unbounded transaction is heavier than needed when only the latest dest matters. Using rex on _raw to rebuild dest, then ignoring the CIM dest field, fails by concept because Network_Traffic already provides dest; rebuilding from _raw wastes effort and risks inconsistent parsing. Using tstats on Web only, because Network_Traffic cannot yield a latest dest, fails by concept because Network_Traffic is a valid CIM source for dest, and Web is the wrong model for that question. Exam caveat: SPLK-5001 expects last() on CIM fields such as dest for latest-value civic network questions when a full transaction is unnecessary. Operational check: run last(dest) by src on Network_Traffic for the suspect IP over the investigation window, validate the most recent dest against a short raw sample, and proceed to host triage on that civic asset rather than building an unbounded transaction first.