splunk challenge 1 queries