The universal forwarder has which capabilities when sending data? (Choose all that apply.)
In case of a conflict between a whitelist and a blacklist input setting, which one is used?
In which Splunk configuration is the SEDCMD used?
Which of the following are supported configuration methods to add inputs on a forwarder? (Choose all that apply.)
Which parent directory contains the configuration files in Splunk?
Which setting in indexes.conf allows data retention to be controlled by time?
