When Splunk is integrated with LDAP, most of the user attributes are managed by the LDAP server and cannot be changed in the Splunk UI. However, one exception is the default app attribute, which specifies which app a user sees when they log in to Splunk. This attribute can be changed in the Splunk UI by editing the user settings.

https://docs.splunk.com/Documentation/Splunk/7.3.0/Admin/Wheretofindtheconfigurationfiles To determine the order of directories for evaluating configuration file precendence, Splunk software considers each file's context. Configuration files operate in either a global context or in the context of the current app and user.

Character encoding is handled during the parsing phase of data processing, which occurs on the indexers. Therefore, the props.conf setting must be deployed to the indexers so the data is correctly decoded and indexed in a usable format.

The configuration shown in the inputs.conffile uses a UDP input
([udp://148.185.131.155:1027]). When Splunk is configured to receive data over UDP, there are certain limitations and behaviors:
1. UDP is a connectionless protocol:
- Data sent to the UDP port is not buffered by Splunk. If Splunk restarts or the process handling the UDP port is interrupted, any data sent during that downtime will be lost because the UDP protocol does not provide retransmission or delivery guarantees.
2. Impact of Splunk restarts:
- Since UDP does not have built-in mechanisms for queuing or resending data, Splunk cannot recover or process data that arrives during a restart.

Immediately after installation, a universal forwarder will start generating internal Splunk logs that contain information about its own operation, such as configuration changes, data inputs, and forwarding activities. These logs are stored in the $SPLUNK_HOME/var/log/splunk directory on the universal forwarder machine. The universal forwarder will not automatically detect any indexers in its subnet and begin routing data, as it needs to be configured with the IP address and port number of the indexer or the deployment server. The universal forwarder will not begin reading local files on its server, as it needs to be configured with the data inputs that specify which files or directories to monitor. The universal forwarder will not send an email to the operator that the installation process has completed, as this is not a default behavior of the universal forwarder and would require additional configuration.