Splunk interview question

don't remember any