QuestionQ35

VerifiedFiltering and Formatting Results

What is the base lispy value in the Search Job Inspector for the search index=sales clientip=170.192.178.10?

Explanation

The Search Job Inspector's base lispy expression represents the terms Splunk actually extracts from a search using Lisp-style prefix notation, where a single AND operator precedes the complete list of terms rather than being repeated pairwise between them. For a search like index=sales clientip=170.192.178.10, the individual numeric segments produced by breaking the IP-address literal on its default minor segmenters are listed once, together with the index clause, under one leading AND.

Community Discussion

No comments yet. Be the first to start the discussion!