simplify splunk search string