How to find anomalies in the sea of Splunk Zeek data