Splunk interview question

Some string manipulation question