In these sorts of interviews you really need to drill down and understand what the interviewer is looking for. A good way to simulate a real interview experience is to do a mock with one of the Splunk Software Engineering experts on Prepfully, rated super strongly on TrustPilot... prepfully.com/practice-interviews