more splunk config