Splunk interview question

General design&implementation.