The followTailattribute in the inputs.conffile allows Splunk to monitor a file for updates without indexing the pre-existing data. When followTailis set to true, Splunk will start indexing only new data added to the file, while ignoring the already indexed content.

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Aboutlicenseviolations In Enterprise license stack with a license volume of 100 GB of data per day or more does not currently violate.

In the inputs.confstanza shown, the host is set to a numeric value (499579049), which suggests the event's timestamp will be indexed based on the timezone of the forwarder, unless otherwise specified. By default, Splunk uses the local timezone of the forwarder to tag events with their timestamp during indexing.

Event processing occurs at the parsing phase of the data pipeline. The parsing phase is where Splunk software processes incoming data into individual events, extracts timestamp information, assigns source types, and performs other tasks to make the data searchable. The parsing phase can also apply field extractions, event type matching, and other transformations to the events.

The app local directories move to second in the priority list. This is explained in the Splunk documentation, which states:
In a clustered environment, the precedence of configuration files changes slightly from that of a standalone deployment. The app local directories move to second in the priority list, after the peer-apps local directory. This means that any configuration files in the app local directories on the individual peers are overridden by configuration files of the same name and type in the peer-apps local directory on the master node.