https://docs.splunk.com/Documentation/Splunk/latest/Indexer/Setaretirementandarchivingpolicy

 The eval command is a distributable streaming command, which means that it can run on the search peers in a distributed environment1. The search peers are the indexers that store the data and perform the initial steps of the search processing2. The eval command calculates an expression and puts the resulting value into a search results field1. In your search, you are using the eval command to create a new field called “responsible_team” based on the values in the “account” field.

According to the Splunk system admin course PDF, When adding native users, Username and Password ARE REQUIRED

When a monitored file has already been indexed into the wrong index, simply changing the index setting does not cause Splunk to re-read the file. Splunk tracks monitored files in the fishbucket so it knows what has already been read.

To re-index the same file, the monitor tracking information must be reset on the forwarder that originally monitored the file. This is done with the btprobe command against the fishbucket database.

The correct process is:

Correct the configuration so future data goes to the right index, Index A.

Stop the forwarder.

Reset the file’s fishbucket entry using btprobe.

Restart the forwarder so the file can be read again.

Use the delete command only to make the incorrectly indexed events unsearchable from Index B.

The delete command does not physically remove events from disk. It marks matching events so they are no longer returned in searches. It also does not reclaim disk space and does not remove buckets.

Option A is incorrect because rebuilding the indexer is not the correct fix for re-indexing a monitored file.

Option B is incorrect because a rebuild command is not the correct method for making a forwarder re-read a monitored file.

Option C is incorrect because the fishbucket reset must be performed on the forwarder that monitored the file, not on the indexer.

Option D is correct because it combines the required configuration correction, fishbucket reset on the forwarder, re-ingestion, and use of the delete command to hide the incorrectly indexed events.

https://docs.splunk.com/Documentation/Splunk/8.0.3/DistSearch/Distributedsearchgroups

https://docs.splunk.com/Documentation/Splunk/8.0.5/Forwarding/Forwarddatatothird-partysystemsd

" You can specify a SEDCMD configuration in props.conf to address data that contains characters that the third-party server cannot process. "

https://docs.splunk.com/Splexicon:Searchpeer

" A Splunk platform instance that responses to search requests from a search head. The term " Search peer " is usually synonymous with the indexer role in a distributed search topology... "