More documentation

Signed-off-by: David Noble <dnoble@splunk.com>