Which Splunk internal index contains license-related events?
_audit

Splunk configuration parameter settings can differ between multiple .conf files of the same name contained within different apps. Which of the following directories has the highest precedence?

Search dashboards in the Monitoring Console indicate that the distributed deployment is approaching its
capacity. Which of the following options will provide the most search performance improvement?

When using the props.conf LINE_BREAKER attribute to delimit multi-line events, the SHOULD_LINEMERGE attribute should be set to what?

Which of the following is true regarding Splunk Enterprise performance? (Select all that apply.)