Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Splunk SPLK-1002 Exam - Topic 6 Question 130 Discussion

Which of the following fields should be normalized using the Splunk Common Information Model (CIM) based on their relationship?
B) src_ip, source_ip
A) src_ip, dest_ip
C) index, sourcetype
D) src_ip, src_port

Splunk SPLK-1002 Exam - Topic 6 Question 130 Discussion

Actual exam question for Splunk's SPLK-1002 exam
Question #: 130
Topic #: 6
[All SPLK-1002 Questions]

Which of the following fields should be normalized using the Splunk Common Information Model (CIM) based on their relationship?

Show Suggested Answer Hide Answer
Suggested Answer: B

Normalization in CIM aligns differing field names that represent the same type of data across multiple sources.

Extract: ''Field aliases and tags are used to map fields with different names but equivalent meaning, such as source_ip and src_ip.''

Thus, src_ip and source_ip should be normalized to represent a common standardized field.


by Margo at Jul 15, 2026, 11:00 AM

Limited Time Offer

25%

Off

Get Premium SPLK-1002 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Ivory
1 day ago
Wait, are we really normalizing src_ip and src_port? Seems odd.
upvoted 0 times
...
Twana
6 days ago
Totally agree with A) and D) being related!
upvoted 0 times
...
Catina
11 days ago
C) index, sourcetype? Not sure about that one.
upvoted 0 times
...
Maryann
17 days ago
I think B) src_ip, source_ip should be normalized too.
upvoted 0 times
...
Laurel
22 days ago
A) src_ip, dest_ip makes sense for normalization.
upvoted 0 times
...
Elvis
27 days ago
I’m leaning towards D because src_ip and src_port are both related to the source of network connections, but I could be wrong.
upvoted 0 times
...
Tomoko
1 month ago
I practiced a question like this before, and I feel like index and sourcetype are more about data categorization rather than normalization.
upvoted 0 times
...
Eladia
1 month ago
I'm not entirely sure, but I remember something about source_ip being similar to src_ip. Maybe B is the right choice?
upvoted 0 times
...
Toi
1 month ago
I think src_ip and dest_ip should definitely be normalized together since they both relate to network traffic.
upvoted 0 times
...

Save Cancel