some usefull staff about splunk