Adding new splunk 500 query syntax to its config.dist