Splunk interview question

how did you understand/frame the problem