https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/User-seedconf
"To set the default username and password, place user-seed.conf in
$SPLUNK_HOME/etc/system/local. You must restart Splunk to enable configurations. If the
$SPLUNK_HOME/etc/passwd file is present, the settings in this file (user-seed.conf) are not used."

The edit_dist_peercapability is required on the Search Peer to authenticate access and manage the configuration related to distributed search in Splunk. This capability allows the user to configure and manage the Search Peers, which are responsible for indexing and searching data in a distributed Splunk environment.

An index is a collection of directories, also called buckets, that contain index files. Each bucket represents a specific time range.
A bucket can be in one of several states, such as hot, warm, cold, frozen, or thawed. Buckets are managed by indexers or clusters of indexers.

https://docs.splunk.com/Documentation/Splunk/7.3.1/Security/SetupuserauthenticationwithSplunk Splunk authentication: Provides Admin, Power and User by default, and you can define your own roles using a list of capabilities. If you have an Enterprise license, Splunk authentication is enabled by default. See Set up user authentication with Splunk's built-in system for more information. LDAP:
Splunk Enterprise supports authentication with its internal authentication services or your existing LDAP server. See Set up user authentication with LDAP for more information. Scripted authentication API: Use scripted authentication to integrate Splunk authentication with an external authentication system, such as RADIUS or PAM. See Set up user authentication with external systems for more information. Note: Authentication, including native authentication, LDAP, and scripted authentication, is not available in Splunk Free.

A Heavy Forwarder is a Splunk instance that can parse and filter data before forwarding it to another Splunk instance, such as an indexer. A Heavy Forwarder can also perform index-time field extractions using the TRANSFORMS setting.
The TRANSFORMS setting is used to configure data transformations in the transforms.conf file.
The transforms.conf file contains settings and values that you can use to configure host and source type overrides, anonymize sensitive data, route events to different indexes, create index- time and search-time field extractions, and set up lookup tables.
The TRANSFORMS setting can be deployed to the Heavy Forwarder where the syslog files are being monitored, so that the logs can be rerouted based on the event message before they are forwarded to the indexer. This can improve the performance and efficiency of data processing and indexing.