solution guide and code for Splunk .conf 2014 session