The monitor stanza in inputs.confspecifies the path pattern
monitor:///var/log/*/bar/.../*.txt, which breaks down as follows:
/var/log/: The path must start with /var/log/.
*: This matches any directory or file name at that level.
/bar/: There must be a directory named barat this level.
...: This indicates that there can be additional directories or subdirectories between barand the .txtfiles.
*.txt: The file must have a .txtextension.

https://answers.splunk.com/answers/131127/scripted-authentication.html
Scripted Authentication: An option for Splunk Enterprise authentication. You can use an authentication system that you have in place (such as PAM or RADIUS) by configuring authentication.conf to use a script instead of using LDAP or Splunk Enterprise default authentication.

https://docs.splunk.com/Documentation/Splunk/8.2.1/Data/Configuretimestamprecognition

When using license pools, volume allocations apply to indexers. A license pool is a group of indexers that share a certain amount of daily indexing volume. The license pool specifies how much data each indexer can index per day, as well as which indexes are available for each indexer.

When the strict_pool_quota=falsesetting is configured in server.conf, it means that individual license pools are not strictly enforced. Instead, the total usage across all pools is compared to the overall license quota. If the total license usage for the day does not exceed the global license limit, no warnings are issued, even if individual pools exceed their assigned quota.
Breakdown of Today's Usage:
- Pool X: 100 GB (within its limit of 500 GB)
- Pool Y: 400 GB (exceeds its limit of 350 GB)
- Pool Z: 300 GB (exceeds its limit of 150 GB)
- Total Usage: 100 GB + 400 GB + 300 GB = 800 GB
The total license limit is 1000 GB/day, and today's total usage (800 GB) is below this threshold.
Therefore, no warnings are issued for any pool because the total usage stays within the global limit, and strict_pool_quota=falseallows pools to exceed their individual quotas.