Using Fields and Lookups →easyMultiple ChoiceObjective-mapped

SPLK-1001 Using Fields and Lookups Practice Question

A security analyst is investigating a suspicious IP address. They want to find all events related to that IP. Which field should they use in a search?

⚠ Common exam trap

Candidates often confuse source_ip with dest_ip, assuming any IP field will work, but Splunk requires field-specific searches to accurately capture the role of the IP in the event.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

source_ip

Source_ip. In Splunk, when investigating a suspicious IP address, the source_ip field identifies the origin of network traffic. By searching for source_ip=<suspicious IP>, you retrieve all events where that IP was the initiator of a connection, which is the most direct way to find events related to that IP in network logs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
source_ip
Why this is correct
source_ip typically contains the originating IP address.
✗
dest_ip
Why it's wrong here
dest_ip is the destination IP, not the source.
✗
host
Why it's wrong here
host refers to the hostname or device name.
✗
user
Why it's wrong here
user is for username, not IP address.

Go deeper

SPLK-1001 Using Fields and Lookups Practice Question

Why each option matters

Option-by-option breakdown

Related to this question