Splunk query interview questions