What is the value of base lispy in Splunk Search Job Inspector?

SPLK-1004 By islever Editorial Last updated

Short answer

D [ AND 10 170 178 192 index::sales ]

Question

What is the value of base lispy in the Search Job Inspector for the search index=sales clientip=170.192.178.10?
  1. [ index::sales 192 AND 10 AND 178 AND 170 ]
  2. [ index::sales AND 469 10 702 390 ]
  3. [ 192 AND 10 AND 178 AND 170 index::sales ]
  4. [ AND 10 170 178 192 index::sales ] Correct Answer

Key Takeaways

The exam tests whether you know that lispy uses sorted numeric order with a prefix AND, so the IP address chunks appear before index::sales, not in the original search order.

Splunk's 'base lispy' field in the Search Job Inspector shows how a search is decomposed into indexed terms and boolean operations. Community consensus (80% votes) identifies option D as correct because lispy sorts terms numerically and places index::sales at the end.

Common mistake: Option A is the most common wrong answer because test-takers see index=sales in the original command and expect index::sales to come first, but lispy normalizes terms to sorted order and puts the index term last.

Expert Analysis

Why the Answer Is Correct

The lispy representation created by the Search Job Inspector is not conventional search syntax. Splunk sorts numeric terms in ascending order and uses prefix notation, so the IP address 170.192.178.10 becomes the sorted list 10, 170, 178, 192. The index constraint index::sales is appended at the end, and the boolean operator AND is placed at the beginning, yielding [ AND 10 170 178 192 index::sales ]. Comment [1] confirms "Lispy sorts alphabetically and number from small to large" and links to Splunk conference slides.

Why the Other Options Are Wrong

Option A places index::sales first and lists the IP chunks in the original order, which mimics the search string but violates lispy's sorted, prefix structure. Option B contains completely unrelated numbers (469, 702, 390) and cannot be derived from the given search. Option C has the correct numeric set but the order is still unsorted (192 first) and uses infix AND, so it does not match Splunk's lispy output. Only D satisfies both the numeric sort and the prefix AND placement.

Community Comment Notes

The community overwhelmingly voted for D, with comment [2] explicitly stating the correct representation: "10 AND 170 AND 178 AND 192 index::sales" and explaining why other options are incorrect. Comment [1] adds the key rule about sorting alphabetically and numerically. Comment [3], which voted for A, reflects the common misconception that lispy preserves the original command order; that comment itself notes the exact order "can vary," but Splunk's lispy is deterministic, making D the only valid choice.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When you see a 'base lispy' question, immediately remember that Splunk reorders indexed terms deterministically: numbers ascend, AND becomes a prefix operator, and index::token is placed at the end. Eliminate any option that preserves the original search wording or lists IP chunks in the exact order they appeared in the query.

Community Votes

D
80%
A
20%

80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Eddie_exam 👍 3 Answered D
    Correct answer is D. Lispy sorts alphabetically and number from small to large. See https://conf.splunk.com/files/2017/slides/fields-indexed-tokens-and-you.pdf
  2. teeec 👍 1 Answered D
    Lispy sorts alphabetically and number from small to large Correct Lispy Representation: [ 10 AND 170 AND 178 AND 192 index::sales ] Analyzing the Answer Choices: A. [ index::sales 192 AND 10 AND 178 AND 170 ] – Incorrect (incorrect order, index::sales appears at the start). B. [ index::sales AND 469 10 702 390 ] – Incorrect (unrelated numbers). C. [ 192 AND 10 AND 178 AND 170 index::sales ] – Incorrect (order of numbers is wrong; 10 should come first). D. [ AND 10 170 178 192 index::sales ] – Correct (proper ascending order and correct placement of index::sales).
  3. c1c8784 👍 1 Answered A
    Splunk “lispy” expansions often break IP addresses into separate terms (170, 192, 178, 10) with boolean AND. The approximate structure is typically [ index::sales <term1> AND <term2> AND ... ]. (Note: the exact order of the IP terms can vary, but the key pattern is index::sales followed by each numeric chunk joined by AND.)
  4. Eddie_exam 👍 1
    Splunk Fundamentals 3 slide 285 also has an example of this but no explanation.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Which Default Splunk Role Can Use the Log Event Alert Action?

S-grade

How Do You Query a Summary Index Populated by a Report Named 'Linux Logins'?

S-grade

What Is the Best Choice for Summarizing Data to Improve Search Performance?

S-grade

Where do search debug messages appear for troubleshooting views?

S-grade

Practice All SPLK-1004 Questions

Access 130 questions with complete answers and detailed explanations.

View Full SPLK-1004 Practice Test →

← Back to SPLK-1004 Study Guide