What is the default character encoding used by Splunk during the input phase?
https://docs.splunk.com/Documentation/Splunk/7.3.1/Data/Configurecharactersetencoding
'Configure character set encoding. Splunk software attempts to apply UTF-8 encoding to your scources by default. If a source foesn't use UTF-8 encoding or is a non-ASCII file, Splunk software tries to convert data from the source to UTF-8 encoding unless you specify a character set to use by setting the CHARSET key in the props.conf file.'
Which of the following are required when defining an index in indexes. conf? (select all that apply)
homePath = $SPLUNK_DB/hatchdb/db
coldPath = $SPLUNK_DB/hatchdb/colddb
thawedPath = $SPLUNK_DB/hatchdb/thaweddb
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf
https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Indexesconf#PER_INDEX_OPTIONS
When deploying apps on Universal Forwarders using the deployment server, what is the correct component and location of the app before it is deployed?
The correct answer is C. On Deployment Server, $SPLUNK_HOME/etc/deployment-apps.
The other options are incorrect because:
In case of a conflict between a whitelist and a blacklist input setting, which one is used?