splunk restoring shell script