The timestamp in the event is in the format H:M:S(13:11:08), and the TIME_FORMATin the first image correctly specifies H:M:Sto extract the timestamp from the event. The MAX_TIMESTAMP_LOOKAHEADvalue of 8 allows Splunk to look ahead and correctly extract the timestamp from the start of the event.

Every Splunk instance has a fishbucket index, except the lightest of hand-tuned lightweight forwarders, and if you index a lot of files it can get quite large. As any other index, you can change the retention policy to control the size via indexes.conf.

When there are conflicting settings within two or more configuration files, the setting with the highest precedence is used. The precedence of configuration files is determined by a combination of the file type, the directory location, and the alphabetical order of the file names.

"You can group your search peers to facilitate searching on a subset of them. Groups of search peers are known as "distributed search groups." You specify distributed search groups in the distsearch.conf file" Reference:
https://docs.splunk.com/Documentation/Splunk/8.0.5/DistSearch/Distributedsearchgroups