When a monitored file has already been indexed into the wrong index, simply changing the index setting does not cause Splunk to re-read the file. Splunk tracks monitored files in the fishbucket so it knows what has already been read.
To re-index the same file, the monitor tracking information must be reset on the forwarder that originally monitored the file. This is done with the btprobe command against the fishbucket database.
The correct process is:
* Correct the configuration so future data goes to the right index, Index A.
* Stop the forwarder.
* Reset the file's fishbucket entry using btprobe.
* Restart the forwarder so the file can be read again.
* Use the delete command only to make the incorrectly indexed events unsearchable from Index B.
The delete command does not physically remove events from disk. It marks matching events so they are no longer returned in searches. It also does not reclaim disk space and does not remove buckets.
Option A is incorrect because rebuilding the indexer is not the correct fix for re-indexing a monitored file.
Option B is incorrect because a rebuild command is not the correct method for making a forwarder re-read a monitored file.
Option C is incorrect because the fishbucket reset must be performed on the forwarder that monitored the file, not on the indexer.
Option D is correct because it combines the required configuration correction, fishbucket reset on the forwarder, re-ingestion, and use of the delete command to hide the incorrectly indexed events.
Reference: Splunk Enterprise Getting Data In Manual, monitor inputs and fishbucket behavior; Splunk Enterprise Troubleshooting Manual, re-index files and reset fishbucket; Splunk Search Reference, delete command.

The serverclass.conf file controls how deployment apps and configurations are distributed from the Deployment Server to its Deployment Clients . Within this configuration, attribute values can be defined at multiple levels, and Splunk applies them based on a defined order of precedence - from general to most specific.
The correct order of evaluation (lowest to highest precedence) is:
* [global] - applies to all server classes and clients unless overridden.
* [serverClass: < name > ] - applies to all clients in that specific server class.
* [serverClass: < name > :app: < appname > ] - applies only to a specific app within that server class and overrides previous settings.
This means that values set in the [serverClass: < name > :app: < appname > ] stanza take priority over those in
[serverClass: < name > ], which in turn override values in [global].
Example (from serverclass.conf):
[global]
whitelist.0 = *
[serverClass:web_servers]
whitelist.0 = web01*
blacklist.0 = test*
[serverClass:web_servers:app:web_monitoring]
restartSplunkWeb = true
Here, restartSplunkWeb = true in the app stanza overrides any inherited setting from the global or class level.
Reference (Splunk Documentation):
* Splunk Enterprise Admin Manual # Deploy configurations using deployment server
* serverclass.conf.spec and example # "Precedence of attributes: global < serverClass: < name > < serverClass: < name > :app: < appname > "
* Splunk Docs: "How the deployment server works"

The Splunk Deployment Server is a centralized component used to distribute configurations and apps to multiple deployment clients , such as forwarders, indexers, or other Splunk instances.
By default, all deployment apps that the Deployment Server manages are stored in the directory:
$SPLUNK_HOME/etc/deployment-apps/
Each subdirectory under this path represents a deployment app that can be pushed to one or more clients based on rules defined in serverclass.conf.
The Deployment Server stages updates in /etc/deployment-apps/ and deploys them to clients based on matching server classes. This mechanism allows centralized management and configuration consistency across distributed Splunk environments.
Reference (Splunk Documentation):
* Splunk Enterprise Admin Manual # Use the deployment server to deploy configurations
* serverclass.conf.spec and example # "Deployment server staging area is $SPLUNK_HOME/etc
/deployment-apps/."
* Splunk Docs: "About deployment server"

Reference:https://docs.splunk.com/Documentation/Splunk/8.2.1/Admin/StartSplunk
https://docs.splunk.com/Documentation/Splunk/8.2.2/Updating/Deploymentserverarchitecture
" A deployment client is a Splunk instance remotely configured by a deployment server " .

Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Updating/ Updateconfigurations#2._Reload_the_deployment_server
https://docs.splunk.com/Documentation/Splunk/8.0.5/Updating/Useserverclass.conf
" Use serverclass.conf to define server classes " " The most important settings define the set of deployment clients and the set of apps for each server class. "