Splunk Interview Question

how did you understand/frame the problem