Splunk’s behavior