Wastewater SCADA events include src_ip, dest_ip, and c2_ip. The analyst wants to flag which of those addresses are RFC1918 without writing three nearly identical eval statements. Which SPL approach fits?
Select an answer to reveal the explanation.
Short Explanation
Copy-pasting the same eval three times is like labeling three identical pump gauges by hand. foreach is the stencil: one expression, applied to every named IP field. That is how an analyst flags RFC1918 on src, dest, and C2 without tripling the SPL.
Full Explanation
foreach repeats an eval-style operation across a list of fields so the same logic is not duplicated. For wastewater telemetry that carries several IP fields, one foreach can test CIDR membership or otherwise transform src_ip, dest_ip, and c2_ip together. transaction groups events in time; it does not flag private addresses. rex extracts from a string and is not a multi-field calculator, and tstats summariesonly does not invent RFC1918 labels.