Splunk interview question

Nothing special.