"Where to place the scripts for scripted inputs. The script that you refer to in $SCRIPT can reside in only one of the following places on the host file system:
$SPLUNK_HOME/etc/system/bin
$SPLUNK_HOME/etc/apps/<your_App>/bin
$SPLUNK_HOME/bin/scripts
As a best practice, put your script in the bin/ directory that is nearest to the inputs.conf file that calls your script on the host file system."

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Typesofforwarders
"A heavy forwarder parses data before forwarding it and can route data based on criteria such as source or type of event."

Splunk uses alayered configuration modelwhere settings are loaded in a specific order. This order determines which configuration takes precedence when multiple settings conflict. Atindex time(the point when data is parsed and indexed), the configuration precedence is clearly defined in the official documentation.
FromSplunk Docs(props.conf precedence):
Configuration file resolution order (highest to lowest precedence):
$SPLUNK_HOME/etc/users/ < username > / < appname > /local
$SPLUNK_HOME/etc/apps/ < appname > /local
$SPLUNK_HOME/etc/apps/ < appname > /default
$SPLUNK_HOME/etc/system/local
$SPLUNK_HOME/etc/system/default
However, forindex-time configurations, a slight difference applies:
system/local and users/local areoften treated specially, butin practice and according to Splunk Docs, thesystem
/localconfigs override apps/default, and so on.
InOption C, the correct precedence fromhighest to lowestis:
/etc/users/local (Highest)
/etc/system/default
/etc/apps/aaa/local
/etc/apps/zzz/default
/etc/system/local (Lowest of these listed)
Though system/local typically has high precedence,when users/local is involved, that is the ultimate override.
Splunk Docs confirms this in:
Configuration file precedence
Configuration layering reference
Therefore, Option C reflects the correct Splunk configuration file precedence order at index time.

https://docs.splunk.com/Documentation/Splunk/8.0.5/Deploy/Datapipeline
"In the input segment, Splunk software consumes data. It acquires the raw data stream from its source, breaks in into 64K blocks, and annotates each block with some metadata keys." Reference: https://docs.splunk.com/Documentation/Splunk/8.0.5/Deploy/Datapipeline

The setting that allows the configuration of Splunk to allow events to span over more than one line is SHOULD_LINEMERGE. This setting determines whether consecutive lines from a single source should be concatenated into a single event. If SHOULD_LINEMERGE is set to true, Splunk will attempt to merge multiple lines into one event based on certain criteria, such as timestamps or regular expressions. Therefore, option A is the correct answer. References: Splunk Enterprise Certified Admin | Splunk, [Configure event line merging - Splunk Documentation]