Add post about picking top fields in Splunk