Reference:https://docs.splunk.com/Documentation/Splunk/8.2.1/Updating/Forwardermanagementoverview
https://docs.splunk.com/Documentation/MSApp/2.0.3/MSInfra/Setupadeploymentserver
"To activate deployment server, you must place at least one app into %SPLUNK_HOME%\etc\deployment- apps on the host you want to act as deployment server. In this case, the app is the "send to indexer" app you created earlier, and the host is the indexer you set up initially.

A modular input script that belongs to a Splunk app is placed inside that app's bin directory. The app directory is located under $SPLUNK_HOME/etc/apps/ < app_name > /, and executable scripts for the app are stored in the bin subdirectory.
Therefore, for an app named cisco_collector, the correct modular input script location is:
$SPLUNK_HOME/etc/apps/cisco_collector/bin/cisco_collector.py
Option B is incorrect because $SPLUNK_HOME/etc/deployment-apps/ is used on a deployment server to store deployment apps before they are distributed to deployment clients. It is not the runtime app path used by Splunk for executing the modular input.
Option C is incorrect because the script must be inside the app's bin directory, not directly under
$SPLUNK_HOME/etc/apps/.
Option D is incorrect because Splunk does not use $SPLUNK_HOME/etc/apps/mod_input/ as the standard location for modular input scripts.
Reference: Splunk Enterprise Admin Manual / Developing Views and Apps for Splunk Web / Modular inputs documentation; Splunk Enterprise Admin Manual, directory structure for apps.

[monitor::/opt/log/crashlog/Jan27crash.txt]. This stanza means that Splunk is monitoring a single local file named Jan27crash.txt in the /opt/log/crashlog/ directory1. The monitor input type is used to monitor files and directories for changes and index any new data that is added2.

Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/SearchReference/Metadata

When a user is assignedmultiple rolesin Splunk and each has a defined srchFilter, Splunk combines these filters using alogical ANDoperation. This ensures that the user can only search within the intersection of constraints imposed by each role.
From Splunk Docs:
"If a user has multiple roles assigned and multiple roles specify srchFilter, Splunk softwareANDs the filters together."
- Source: Splunk Documentation - authorize.conf
Let's break it down:
role_A specifies: sourcetype!=json AND index=main
role_B specifies: sourcetype=csv
To evaluate the effective search filter for the user, Splunk willANDthe two conditions:
(sourcetype=csv) AND (sourcetype!=json AND index=main)
This means the user's search is limited to events where:
sourcetype=csv (from role_B)
sourcetype!=json AND index=main (from role_A)
Combining them together logically:
srchFilter = ((sourcetype=csv) AND (sourcetype!=json AND index=main))
This is exactly what is shown inOption A.
Reference:
authorize.conf - Splunk Admin Manual