Home / cybersecurity / Splunk Enterprise Certified Admin (SPLK-1003) / Cheat Sheet
Splunk Enterprise Certified Admin (SPLK-1003)· Exam reference card · 2026 · Edureify AI
Splunk Enterprise Certified Admin (SPLK-1003)

SPLK-1003 Cheat Sheet

SPLK-1003 Tests Which conf File, Stanza and Tier Does the Job

For admins running Splunk Enterprise, not searchers. Most items hinge on where a setting lives and which instance actually executes it, so trace every requirement through the input, parsing and indexing pipeline.

Check Your Readiness →
Among the harder certs
Avg: Not published by Splunk
Pass: 750 / 1000
Most candidates understand Splunk Enterprise Certified Admin (SPLK-1003) concepts — and still fail. This exam tests how you apply knowledge under pressure.
Core Framework

SPLK-1003 Blueprint (17 Topics, Grouped)

Seventeen official topics (eleven at 5%, three at 10%) are grouped here into eight. Questions show stanzas, paths and symptoms and ask for the effective value or missing setting. From 20 October 2026, Splunk certification registration and support moved to Cisco.

  1. 01
    Inputs: staging, monitor, network/scripted, agentless (20%) — indexing phases, monitor options, tcp/udp, scripts, WMI, HEC
  2. 02
    Parsing and data manipulation (15%) — input-phase props, LINE_BREAKER, timestamps, TRANSFORMS, nullQueue, SEDCMD
  3. 03
    Admin basics, licensing, config files (15%) — components, ports, license stacks and violations, precedence, btool
  4. 04
    Splunk Indexes (10%) — bucket lifecycle, retention attributes, frozen behaviour, integrity, fishbucket
  5. 05
    Users and authentication (10%) — role inheritance, index access, can_delete, LDAP mapping, SAML, Duo/RSA MFA
  6. 06
    Distributed Search (10%) — map/reduce split, knowledge bundle, distsearch.conf groups, search head clusters
  7. 07
    Getting data in and forwarder config (10%) — receiving, splunktcp, outputs.conf, load balancing, useACK, maxKBps
  8. 08
    Forwarder Management (10%) — deployment server, deployment-apps, server classes, filters, phone home
Scenario Traps

Wrong instinct vs correct approach

An app was added to etc/deployment-apps and serverclass.conf edited by hand; no client gets it
✕ Wrong instinct

Restart every forwarder so they pull the app

✓ Correct approach

Run splunk reload deploy-server so the deployment server rereads its apps and classes. Clients pull at their phone-home interval anyway; set restartSplunkd on the app when inputs or outputs change.

An index sets 30-day retention and maxTotalDataSizeMB = 100000, and hits that size after 20 days
✕ Wrong instinct

Nothing freezes until the 30-day age limit is reached

✓ Correct approach

Whichever limit triggers first wins: the oldest buckets freeze now on size, and with no archive setting they are deleted. Age-based freezing uses the newest event in a bucket, not the oldest.

Security requires no forwarded events lost if an indexer crashes before writing to disk
✕ Wrong instinct

TCP already guarantees delivery, so nothing is needed

✓ Correct approach

Enable useACK in outputs.conf. The forwarder keeps blocks until the indexer acknowledges they are written and resends any that are not. Compression saves bandwidth and SSL protects confidentiality; neither prevents loss.

Firewalls need only some events kept; the admin lists setnull after setparsing in TRANSFORMS
✕ Wrong instinct

Order does not matter as long as both transforms exist

✓ Correct approach

Transforms run left to right, so the catch-all nullQueue must come first and the indexQueue transform for kept events second. Otherwise the last match sends everything to nullQueue, which is not charged to the license.

Quick Rules

Know these cold

  • ▸ Ports — 000 Splunk Web, 8089 management and deployment clients, 9997 receiving by convention, 8088 HEC
  • ▸ Deployment server for forwarders, deployer for SHC members, cluster manager for indexer peers
  • ▸ Buckets — ot (writable), warm, cold, frozen (deleted by default), thawed (exempt from retention)
  • ▸ maxDataSize sizes hot buckets; maxTotalDataSizeMB caps the index, default 500,000 MB
  • ▸ Monitor blacklist beats whitelist; both are regex on full path; directories recurse by default
  • ▸ Identical file headers skipped — aise initCrcLength (default 256) or set crcSalt = <SOURCE>
  • ▸ LINE_BREAKER capture group text is discarded; TRUNCATE default 10,000 bytes, MAX_EVENTS 256 lines
  • ▸ Sourcetype override — EST_KEY = MetaData:Sourcetype with FORMAT = sourcetype::<name>
  • ▸ HEC needs Global Settings enabled plus a token; HTTP 200 alone does not mean indexed
  • ▸ LDAP login needs a group mapped to a role; native accounts win same-name conflicts
Self Check

Can you answer these without checking your notes?

In this scenario: "An app was added to etc/deployment-apps and serverclass.conf edited by hand; no client gets it" — what should you do first?
Run splunk reload deploy-server so the deployment server rereads its apps and classes. Clients pull at their phone-home interval anyway; set restartSplunkd on the app when inputs or outputs change.
In this scenario: "An index sets 30-day retention and maxTotalDataSizeMB = 100000, and hits that size after 20 days" — what should you do first?
Whichever limit triggers first wins: the oldest buckets freeze now on size, and with no archive setting they are deleted. Age-based freezing uses the newest event in a bucket, not the oldest.
In this scenario: "Security requires no forwarded events lost if an indexer crashes before writing to disk" — what should you do first?
Enable useACK in outputs.conf. The forwarder keeps blocks until the indexer acknowledges they are written and resends any that are not. Compression saves bandwidth and SSL protects confidentiality; neither prevents loss.
Failure Patterns

Common Exam Mistakes — What candidates get wrong

Putting LINE_BREAKER, TIME_FORMAT or masking transforms on a universal forwarder

The UF stops after the input phase. Line breaking, timestamps, TRANSFORMS- and SEDCMD run on the first heavy forwarder or indexer in the path, and indexers never re-parse cooked data from a heavy forwarder.

Applying user-first precedence to inputs.conf or indexes.conf

Global context runs system/local, then app local, then app default, then system/default, with apps compared in ASCII directory order. User directories only matter for search-time knowledge objects. Confirm with splunk btool <file> list --debug.

Believing frozen buckets are archived and that violations stop indexing

Frozen buckets are deleted unless coldToFrozenDir or coldToFrozenScript is set. In a license violation, Splunk keeps indexing and restricts search of non-internal data on enforced licenses. Usage is raw daily ingest, not disk size.

Building a restricted role by inheriting from power and unchecking capabilities

Inheritance only adds; inherited capabilities and indexes cannot be removed. Start from user, then set srchIndexesAllowed for access. srchIndexesDefault only sets which indexes are searched when none is specified.

Using a [tcp://9997] stanza to receive data from forwarders

Forwarder traffic is the Splunk-to-Splunk protocol and needs [splunktcp://9997], which is a convention you must enable, never open by default. Raw tcp and udp stanzas are for devices such as syslog senders.

Continue your prep

Resources to help you pass Splunk Enterprise Certified Admin on your first attempt

Practice Questions

Strengthen weak areas with exam-style practice questions and detailed explanations.

Mock Exam

Simulate the real exam experience and assess your readiness under timed conditions.

Study Guide

Review key concepts, objectives, and exam topics in one place.

AI Tutor

Get personalized explanations, learning recommendations, and instant answers.

SPLK-1003 Training

Follow a structured learning path designed to help you prepare efficiently.

SPLK-1003 rewards knowing where each setting lives and which tier runs it. Check yourself.

Start Diagnostic Test → View all exams
Other cybersecurity Cheat Sheet