Getting Splunk running was only the beginning.