Through questions like this, interviewers are mostly trying to test your skillset (and its relevance to the role) as robustly as possible, so be prepared for multiple offshoots and followups. It could be a useful exercise to do mocks with friends or colleagues in Splunk to get a real sense of what the interview is actually like. Alternatively Prepfully has a ton of Splunk Software Engineer experts who provide mock interviews for a pretty reasonable amount. prepfully.com/practice-interviews