SPLK-1001 src_ip field Practice Question
A search using index=security sourcetype=windows_security returns events with EventCode=4625. The user wants to find the top 10 source IP addresses. Which search will accomplish this?
⚠ Common exam trap
In Splunk, for Windows security event 4625, the source IP is automatically extracted into the `src_ip` field by the TA. Candidates often try to use `rex` unnecessarily, which can be error-prone.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
index=security sourcetype=windows_security | top 10 src_ip
For Windows security events with EventCode 4625, Splunk (with the appropriate TA) automatically extracts the source IP address into a field named `src_ip`. Therefore, the search `index=security sourcetype=windows_security | top 10 src_ip` directly provides the top 10 source IP addresses from all events. The first filter for EventCode=4625 is omitted in this option, but the question stem states that the initial search already returns only those events, so the filter is redundant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
index=security sourcetype=windows_security EventCode=4625 | rex field=Account "from (\d+\.\d+\.\d+\.\d+)" | top 10 ip
Why it's wrong here
This command uses `rex` without a named capture group, so it does not create a field named `ip`. The `top 10 ip` command would fail because no `ip` field exists. Therefore, option A is incorrect.
- ✗
index=security sourcetype=windows_security EventCode=4625 | top 10 Account
Why it's wrong here
This command runs `top 10 Account`, but the `Account` field contains the full string like 'from 10.0.0.1', not just the IP. This would count those strings, not extract the IP address. Hence, option B is incorrect.
- ✓
index=security sourcetype=windows_security | top 10 src_ip
Why this is correct
This command uses the `src_ip` field which is automatically extracted for EventCode 4625 by the Windows TA. The `top 10 src_ip` returns the most common source IPs. Even though the filter for EventCode=4625 is missing, the stem indicates the initial search already limits events to that code. Thus, option C is correct.
- ✗
index=security sourcetype=windows_security EventCode=4625 | table Account | top 10
Why it's wrong here
This command first uses `table Account` which limits output to only the `Account` field, then `top 10` attempts to top that field, but the `top` command requires a field argument. Even if it worked, it would count `Account` values, not IP addresses. Therefore, option D is incorrect.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SPLK-1001 question from scratch — 502 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SPLK-1001 practice question is part of Courseiva's free Splunk certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SPLK-1001 exam.