Splunk Add Total Work