https://docs.splunk.com/Documentation/SplunkCloud/8.2.2111/Data/Usepersistentqueues

The Splunk component that requires a separate installation package is the universal forwarder.
The universal forwarder is a lightweight Splunk agent that forwards data to indexers or other forwarders. The universal forwarder has a different installation package than the Splunk Enterprise package, which includes all the other Splunk components.

Role-to-group mapping changes for external authentication are applied at login time, so users who are already logged in continue operating under their existing role assignments until they log out and log back in.

https://docs.splunk.com/Documentation/Splunk/8.2.2/DistSearch/Configuredistributedsearch To activate distributed search, you add search peers, or indexers, to a Splunk Enterprise instance that you desingate as a search head. You do this by specifying each search peer manually.

https://wiki.splunk.com/Deploy:BucketRotationAndRetention