Wastewater SCADA events include src_ip, dest_ip, and c2_ip. The analyst wants to flag which of those addresses are RFC1918 without writing three nearly identical eval statements. Which SPL approach fits?
Select an answer to reveal the explanation.
Short Explanation
Copy-pasting the same eval three times is like labeling three identical pump gauges by hand. foreach is the stencil: one expression, applied to every named IP field. That is how an analyst flags RFC1918 on src, dest, and C2 without tripling the SPL.
Full Explanation
foreach applies the same eval-style expression across a named list of fields so wastewater SCADA hunts do not triplicate identical logic for src_ip, dest_ip, and c2_ip. That is the right SPL when the analyst needs one RFC1918 or CIDR membership test—or any shared transform—written once and executed on each address field. The result is consistent private-range flags without copy-paste drift across civic OT field names. transaction collapses events into time-bounded sessions; it does not evaluate CIDR membership or label RFC1918 on multiple IP fields. A single rex on _raw extracts substrings from text; it is not a multi-field calculator and cannot update every named IP field merely because one pattern exists. tstats summariesonly=true reads accelerated summaries and does not invent RFC1918 labels or filter the live model down to private addresses by itself. Exam caveat: foreach still needs a correct expression (cidrmatch, if/like patterns, or similar); naming the fields is not enough if the predicate is wrong. Operational check: run foreach over src_ip, dest_ip, and c2_ip with a known private and public sample address, confirm each field receives the expected RFC1918 flag, and reuse that block in the SCADA hunt rather than three separate evals.