A permitting-office analyst needs to attach DHCP hostnames to firewall src addresses. A teammate suggests using rex to join the two datasets. What should the analyst do instead?
Select an answer to reveal the explanation.
Short Explanation
rex is a pair of scissors for cutting a field out of a string — it is not glue. To hang a DHCP hostname on a firewall src, use lookup, a stats/join on the shared CIM src, or the already-normalized src field — not a regex 'join'.
Full Explanation
rex extracts substrings into fields; it does not join two datasets. Binding civic DHCP hostnames to firewall sources belongs to lookup, to join or stats on a shared key, or to CIM src already normalized by the add-ons. makeresults does not perform that join, and foreach over _time does not attach leases. Choose the command that matches the job: extract versus enrich.