https://docs.splunk.com/Documentation/Splunk/8.0.6/Security/ManageSplunkuserroleswithLDAP

A role in Splunk is a classification that determines what capabilities and indexes a user has. A capability is a permission to perform a specific action or access a specific feature on the Splunk platform1. An index is a collection of data that Splunk software processes and stores2. By assigning roles to users, you can control what they can do and what data they can access on the Splunk platform.
Therefore, the correct answers are A and D. A role in Splunk determines what capabilities and indexes a user has. Option B is incorrect because Splunk servers do not use roles to remotely control each other. Option C is incorrect because Splunk servers use instances and components to determine what functions they control3.
References: 1: Define roles on the Splunk platform with capabilities - Splunk Documentation 2: About indexes and indexers - Splunk Documentation 3: Splunk Enterprise components - Splunk Documentation

https://www.splunk.com/en_us/blog/tips-and-tricks/what-is-this-fishbucket-thing.html
"Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf" Reference https://community.splunk.com/t5/Archive/How-to-reindex-data-from-a-forwarder/td-p/93310

Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/ AboutsecuringyourSplunkconfigurationwithSSL