Which field is automatically added to search results when assets are properly defined and enabled in Splunk Enterprise Security?

Question

Options

• Aasset_category
• Bsrc_ip
• Csrc_category
• Duser

• B
  2% (1)
• C
  95% (39)
• D
  2% (1)

Explanation

When assets are properly defined and enabled in Splunk Enterprise Security, the src_category field is automatically added to search results because ES performs asset lookups against the Asset table and enriches events by appending category information derived from the matched asset's identity data - specifically tagging the source with its assigned category (e.g., "server," "pci," "dmz"). Option A (asset_category) is a distractor; while it sounds plausible, it is not the actual field name ES injects. Option B (src_ip) already exists as a standard field extracted from raw events and is not added by the asset lookup process. Option D (user) is an identity field populated through the Identity framework, not the Asset framework.

Memory tip: Think "src = source asset, category = what ES adds." The Asset framework enriches source fields with category labels → src_category. If you see _category on the exam, pair it with src_ for assets.

No community discussion yet for this question.