MENU
Which of the following fields should be normalized using the Splunk Common Information Model (CIM) based on their relationship?
Suggested Answer: B
Get Premium SPLK-1002 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Normalization in CIM aligns differing field names that represent the same type of data across multiple sources.
Extract: ''Field aliases and tags are used to map fields with different names but equivalent meaning, such as source_ip and src_ip.''
Thus, src_ip and source_ip should be normalized to represent a common standardized field.
15 comments · newest first
SA
Sage
15 days ago
C is important for indexing, but not as much as A.
VA
Vallie
20 days ago
D captures the connection aspect well.
HE
Hermila
26 days ago
A shows clear relationships between source and destination.
SA
Sage
1 month ago
C seems relevant too, but I lean towards A.
VA
Vallie
1 month ago
I prefer D. It makes sense to link src_ip and src_port.
HE
Hermila
1 month ago
I think A is the best choice.
IV
Ivory
2 months ago
Wait, are we really normalizing src_ip and src_port? Seems odd.
TW
Twana
2 months ago
Totally agree with A) and D) being related!
CA
Catina
2 months ago
C) index, sourcetype? Not sure about that one.
MA
Maryann
2 months ago
I think B) src_ip, source_ip should be normalized too.
LA
Laurel
2 months ago
A) src_ip, dest_ip makes sense for normalization.
EL
Elvis
2 months ago
I’m leaning towards D because src_ip and src_port are both related to the source of network connections, but I could be wrong.
TO
Tomoko
3 months ago
I practiced a question like this before, and I feel like index and sourcetype are more about data categorization rather than normalization.
EL
Eladia
3 months ago
I'm not entirely sure, but I remember something about source_ip being similar to src_ip. Maybe B is the right choice?
TO
Toi
3 months ago
I think src_ip and dest_ip should definitely be normalized together since they both relate to network traffic.