SPLUNK Enterprise Certified Admin

Which parent directory contains the configuration files in Splunk?

Which forwarder type can parse data prior to forwarding?

Which Splunk component consolidates the individual results and prepares reports in a distributed environment?

Where should apps be located on the deployment server that the clients pull from?

This file has been manually created on a universal forwarder:
/opt/splunkforwarder/etc/apps/my_TA/local/inputs.conf
[monitor:///var/log/messages]
sourcetype=syslog
index=syslog
A new Splunk admin comes in and connects the universal forwarders to a deployment server and deploys the same app with a new inputs.conf file:
/opt/splunk/etc/deployment-apps/my_TA/local/inputs.conf
[monitor:///var/log/maillog]
sourcetype=maillog
index=syslog
Which file is now monitored?

When configuring monitor inputs with whitelists or blacklists, what is the supported method of filtering the lists?

What is required when adding a native user to Splunk? (Select all that apply.)

What are the minimum required settings when creating a network input in Splunk?

Which Splunk component requires a Forwarder license?

Which optional configuration setting in inputs.conf allows you to selectively forward the data to specific indexer(s)?