https://docs.splunk.com/Documentation/Splunk/8.2.2/DMC/DMCprerequisites Monitoring Console setup prerequisites. Forward internal logs (both
$SPLUNK_HOME/car/log/splunk and $SPLUNK_HOME/var/log/introspection) to indexers from all other components. Without this step, many dashboards will lack data.

https://docs.splunk.com/Documentation/Splunk/8.2.2/Data/UsetheHTTPEventCollector The HTTP Event Collector (HEC) lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols. HEC uses a token-based authentication model. You can generate a token and then configure a logging library or HTTP client with the token to send data to HEC in a specific format. This process eliminates the need for a Splunk forwarder when you send application events.

Reuse of the same field-extracting regular expression across multiple sources, source types, or hosts.
https://docs.splunk.com/Documentation/Splunk/8.0.4/Admin/Propsconf#props.conf.spec

https://docs.splunk.com/Documentation/Splunk/8.0.5/Security/Secureyouradminaccount