In which directory should base config app(s) be placed to initialize an indexer?

Consider the scenario where the /var/logdirectory contains the files secure, messages, cron, audit. A customer has created the following inputs.confstanzas in the same Splunk app in order to attempt to monitor the files secure and messages:

Which file(s) will actually be actively monitored?
/var/log/secure

When a bucket rolls from cold to frozen on a clustered indexer, which of the following scenarios occurs?

In a large cloud customer environment with many (>100) dynamically created endpoint systems, each with a UF already deployed, what is the best approach for associating these systems with an appropriate serverclass on the deployment server?

What should be considered when running the following CLI commands with a goal of accelerating an index cluster migration to new hardware?