Explanation
According to the Splunk Enterprise Security documentation, one of the benefits of data normalization is that searches can be built no matter the specific source technology for a normalized data type. Data normalization is a way to ingest and store data in the Splunk platform using a common format for consistency and efficiency.
When data is normalized, it follows the same field names and event tags for equivalent events from different sources or vendors. This allows you to perform cross-source analysis and correlation of security events without worrying about the differences in data formats. For example, if you have data from Windows, Linux, and Mac OS systems, you can normalize them using the Endpoint data model and use the same fields, such as ,
, and , to search for endpoint events across all systems. Therefore, the correct answer is C. Searches can be built no matter the specific source technology for a normalized data type. References = Data sources and normalization Splunk Common Information Model Add-on Onboarding data to Splunk Enterprise Security