SPLK-1003 study guide · 2026
17 domains and 54 official objectives. Splunk Indexes carries the most weight at 10%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.
Bar widths follow the official weights. Weight ranges are drawn at their midpoint.
54 official objectives 63–100 hrs suggested study
The opening blueprint topic checks that you can name every Splunk Enterprise component, say what work it performs, and place it correctly in a single-instance or distributed deployment before any configuration questions begin.
Inside this domain
Watch for Deployer for forwarders
This topic covers which Splunk Enterprise licenses exist, how daily ingest is metered against them through the license manager, and what warnings and violations mean for searching and indexing.
Inside this domain
Watch for Data is dropped
Configuration files drive every Splunk setting. This topic tests where .conf files live, how copies merge into one effective configuration, which copy wins in a conflict, and how to prove the result with btool.
Inside this domain
Watch for App local beats system local
One of the three heaviest SPLK-1003 topics, Splunk Indexes tests how indexes are laid out on disk, how buckets age from hot to frozen, which indexes.conf settings control that, and how data integrity and retention are enforced.
Inside this domain
Watch for Frozen is archived
User Management covers Splunk's role-based access model: what the built-in roles allow, how to build a custom role with capabilities, inheritance and index restrictions, and how native Splunk users are created and assigned roles.
Inside this domain
Watch for Remove inherited capability
Authentication Management covers how Splunk verifies users: connecting to LDAP and mapping groups to roles, choosing among SAML, scripted and native options, and adding multifactor authentication through supported providers.
Inside this domain
Watch for Bind means login
Getting Data In introduces how data enters Splunk: the metadata every input sets, the universal and heavy forwarder types, the outputs and receiving configuration that connect forwarders to indexers, and CLI commands that add inputs on a universal forwarder.
Inside this domain
Watch for Receiving is automatic
Distributed Search, one of the three 10% topics, explains how a search head sends work to indexers acting as search peers, how peers and peer groups are configured, and which options scale the search tier as users and load grow.
Inside this domain
Watch for Data moves to search head
This staging topic places every input inside Splunk's data pipeline: the input, parsing and indexing phases and what happens in each, plus the full range of input types an admin can choose from before configuring them in later topics.
Inside this domain
Watch for UF parses timestamps
Configuring Forwarders goes beyond a basic outputs.conf: automatic load balancing across indexers, indexer acknowledgement to protect data in transit, compression and SSL, throughput limits, indexer discovery and intermediate forwarding tiers.
Inside this domain
Watch for Load balancing copies data
Forwarder Management, a 10% topic, covers using a deployment server to manage many Splunk instances: building deployment apps, grouping clients into server classes, configuring deployment clients to phone home, and monitoring what was deployed.
Inside this domain
Watch for Server pushes
Monitor Inputs covers collecting files and directories: writing monitor stanzas, using optional settings such as allow and deny lists, crcSalt and ignoreOlderThan, and deploying the same monitor input to remote forwarders.
Inside this domain
Watch for Reset the fishbucket
Network and Scripted Inputs covers collecting data that is not sitting in files: listening for TCP and UDP streams such as syslog, tuning those inputs with optional settings, and running scripts on a schedule to index their output.
Inside this domain
Watch for splunktcp for syslog
Agentless Inputs covers two ways to collect data without installing a forwarder on the source: querying remote Windows machines through WMI and receiving events that applications send to the HTTP Event Collector using tokens.
Inside this domain
Watch for Token alone is enough
Fine Tuning Inputs explains what Splunk does to data in the input phase before parsing begins, and how admins adjust it, especially sourcetype assignment and character set encoding, using props.conf on the instance that first reads the data.
Inside this domain
Watch for Indexer handles CHARSET
Parsing Phase and Data covers how Splunk turns a stream of raw text into events with correct timestamps: default parsing behaviour, line-breaking settings in props.conf, timestamp and time zone extraction, and validating results with Data Preview.
Inside this domain
Watch for Parse on the UF
The final blueprint topic covers changing data before it is indexed: defining index-time transforms in props.conf and transforms.conf to mask values, override sourcetype or host, route events to indexes and drop unwanted events, and using SEDCMD for simple edits.
Inside this domain
Watch for REPORT for routing
Marks follow weight. This order puts the most marks behind you first, across about 63–100 hrs of study.
The answer that looks right, and the clue that gives it away.
Clue The targets are universal forwarders.
Clue The question asks what happens to incoming data.
Clue The setting is an input or index-time attribute.
Clue The stanza has no archive setting.
Clue The role must have fewer rights than its parent.
Clue Users authenticate but are refused access.
Clue Forwarder logs show connection refused.
Clue The question asks where most processing happens.
Study guides for exams that overlap with SPLK-1003.
SPLK-1003 has 17 domains with 54 official objectives between them: Splunk Admin Basics, License Management, Splunk Configuration Files, Splunk Indexes, Splunk User Management, Splunk Authentication Management, Getting Data In, Distributed Search, Getting Data In – Staging, Configuring Forwarders, Forwarder Management, Monitor Inputs, Network and Scripted Inputs, Agentless Inputs, Fine Tuning Inputs, Parsing Phase and Data and Manipulating Raw Data.
Splunk Indexes is the heaviest at 10%, followed by Distributed Search (10%). The lightest is Manipulating Raw Data (5%). Weights come from Splunk's official outline.
Questions: 56. Time allowed: 60 minutes (57 minutes for questions plus 3 minutes to review the exam agreement). Passing score: Not published.
Our planning estimate is 63–100 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.
Start with Splunk Indexes, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.
This guide follows Splunk Enterprise Certified Admin test blueprint, 17 topics (current as of October 2026; undated), published by Splunk. It was last reviewed in October 2026.
Domain names, weights and objectives come from Splunk's official outline (Splunk Enterprise Certified Admin test blueprint, 17 topics (current as of October 2026; undated)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.