Text this: Splunk best practices :