"Where to place the scripts for scripted inputs. The script that you refer to in $SCRIPT can reside in only one of the following places on the host file system:
$SPLUNK_HOME/etc/system/bin
$SPLUNK_HOME/etc/apps/<your_App>/bin
$SPLUNK_HOME/bin/scripts
As a best practice, put your script in the bin/ directory that is nearest to the inputs.conf file that calls your script on the host file system."

The failOpen setting in the [duoMFA] stanza determines how Splunk software handles authentication requests when it cannot connect to the Duo Security service. If failOpen is set to True, as in this example, Splunk software allows users to log in without completing a multifactor challenge. If failOpen is set to False, Splunk software denies all logins when it cannot connect to Duo Security. This setting is independent of the authentication type or the secretKey protection. References = Connect to Duo Security for multifactor authentication

Immediately after installation, a universal forwarder will start generating internal Splunk logs that contain information about its own operation, such as configuration changes, data inputs, and forwarding activities1. These logs are stored in the $SPLUNK_HOME/var/log/splunk directory on the universal forwarder machine1. The universal forwarder will not automatically detect any indexers in its subnet and begin routing data, as it needs to be configured with the IP address and port number of the indexer or the deployment server2. The universal forwarder will not begin reading local files on its server, as it needs to be configured with the data inputs that specify which files or directories to monitor2. The universal forwarder will not send an email to the operator that the installation process has completed, as this is not a default behavior of the universal forwarder and would require additional configuration3.

Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Data/Configureeventlinebreaking Line breaking, which uses the LINE_BREAKER setting to split the incoming stream of data into separate lines. By default, the LINE_BREAKER value is any sequence of newlines and carriage returns. In regular expression format, this is represented as the following string: ([\r\n]+). You don't normally need to adjust this setting, but in cases where it's necessary, you must configure it in the props.conf configuration file on the forwarder thatsends the data to Splunk Cloud Platform or a Splunk Enterprise indexer.
The LINE_BREAKER setting expects a value in regular expression format.

--reset Reset the fishbucket for the given key or file in the btree. Resetting the checkpoint for an active monitor input reindexes data, resulting in increased license use.https://docs.splunk.com/Documentation/Splunk
/8.1.1/Troubleshooting/CommandlinetoolsforusewithSupport
Reference:
http://docshare02.docshare.tips/files/4773/47733589.pdf