A.[udp://172.16.10.1:9997]
connection = dns
sourcetype = dns

B.[any://172.16.10.1:10001]
connection_host = ip
sourcetype = web

C.[tcp://172.16.10.1:9997]
connection_host = web
sourcetype = web

D.[tcp://172.16.10.1:10001]
connection_host = dns
sourcetype = dns

A.index=test

B.index=summary

C.index=_internal

A.SHOULD_LINEMERGE = true

B.SHOULD_LINEMERGE = false

C.BREAK_ONLY_BEFORE_DATE = true

D.BREAK_ONLY_BEFORE = <REGEX pattern>

A.The search head dispatches searches to the search peers.

B.Search results are replicated within the indexer cluster.

C.Forwarders pull data from the search peers.

D.Search heads store a portion of the searchable data.

A.License data

B.Metrics data

C.Internal Splunk data

D.Internal Windows logs