Exam SPLK-1004 topic 1 question 61 discussion

Lispy sorts alphabetically and number from small to large Correct Lispy Representation: [ 10 AND 170 AND 178 AND 192 index::sales ] Analyzing the Answer Choices: A. [ index::sales 192 AND 10 AND 178 AND 170 ] – Incorrect (incorrect order, index::sales appears at the start). B. [ index::sales AND 469 10 702 390 ] – Incorrect (unrelated numbers). C. [ 192 AND 10 AND 178 AND 170 index::sales ] – Incorrect (order of numbers is wrong; 10 should come first). D. [ AND 10 170 178 192 index::sales ] – Correct (proper ascending order and correct placement of index::sales).

Splunk “lispy” expansions often break IP addresses into separate terms (170, 192, 178, 10) with boolean AND. The approximate structure is typically [ index::sales <term1> AND <term2> AND ... ]. (Note: the exact order of the IP terms can vary, but the key pattern is index::sales followed by each numeric chunk joined by AND.)

Splunk Fundamentals 3 slide 285 also has an example of this but no explanation.

Correct answer is D. Lispy sorts alphabetically and number from small to large. See https://conf.splunk.com/files/2017/slides/fields-indexed-tokens-and-you.pdf