What is the value of base lispy in Splunk Search Job Inspector?
What is the value of base lispy in the Search Job Inspector for the search index=sales clientip=170.192.178.10?
Community Votes
80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you know that lispy uses sorted numeric order with a prefix AND, so the IP address chunks appear before index::sales, not in the original search order.
Splunk's 'base lispy' field in the Search Job Inspector shows how a search is decomposed into indexed terms and boolean operations. Community consensus (80% votes) identifies option D as correct because lispy sorts terms numerically and places index::sales at the end.
Option A is the most common wrong answer because test-takers see index=sales in the original command and expect index::sales to come first, but lispy normalizes terms to sorted order and puts the index term last.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The lispy representation created by the Search Job Inspector is not conventional search syntax. Splunk sorts numeric terms in ascending order and uses prefix notation, so the IP address 170.192.178.10 becomes the sorted list 10, 170, 178, 192. The index constraint index::sales is appended at the end, and the boolean operator AND is placed at the beginning, yielding [ AND 10 170 178 192 index::sales ]. Comment [1] confirms "Lispy sorts alphabetically and number from small to large" and links to Splunk conference slides.
Why the Other Options Are Wrong
Option A places index::sales first and lists the IP chunks in the original order, which mimics the search string but violates lispy's sorted, prefix structure. Option B contains completely unrelated numbers (469, 702, 390) and cannot be derived from the given search. Option C has the correct numeric set but the order is still unsorted (192 first) and uses infix AND, so it does not match Splunk's lispy output. Only D satisfies both the numeric sort and the prefix AND placement.
Community Comment Notes
The community overwhelmingly voted for D, with comment [2] explicitly stating the correct representation: "10 AND 170 AND 178 AND 192 index::sales" and explaining why other options are incorrect. Comment [1] adds the key rule about sorting alphabetically and numerically. Comment [3], which voted for A, reflects the common misconception that lispy preserves the original command order; that comment itself notes the exact order "can vary," but Splunk's lispy is deterministic, making D the only valid choice.
Official Reference
Exam Strategy
When you see a 'base lispy' question, immediately remember that Splunk reorders indexed terms deterministically: numbers ascend, AND becomes a prefix operator, and index::token is placed at the end. Eliminate any option that preserves the original search wording or lists IP chunks in the exact order they appeared in the query.
Related Analysis
Practice All SPLK-1004 Questions
Access 130 questions with complete answers and detailed explanations.
View Full SPLK-1004 Practice Test →