What is the value of base lispy in the Search Job Inspector for the search index=sales clientip=170.192.178.10?
What is the value of base lispy in the Search Job Inspector for the search index=sales clientip=170.192.178.10?
The value of base lispy in the Search Job Inspector for the given search query appears in the form of [ index::sales 192 AND 10 AND 178 AND 170 ]. This translates the search query into its base components, representing the search index and client IP address components in the specified sequence.
Correct answer is D. Lispy sorts alphabetically and number from small to large. See https://conf.splunk.com/files/2017/slides/fields-indexed-tokens-and-you.pdf
Splunk Fundamentals 3 slide 285 also has an example of this but no explanation.