SPLK-1003 · Domain 14 of 17

SPLK-1003 Domain 14: Agentless Inputs

Agentless Inputs covers two ways to collect data without installing a forwarder on the source: querying remote Windows machines through WMI and receiving events that applications send to the HTTP Event Collector using tokens.

Exam weight
5%
Official objectives
2
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 9 min read Reviewed October 2026

Overview

Domain 14 has two official objectives: creating Windows Management Instrumentation (WMI) inputs and describing the HTTP Event Collector. WMI inputs let a Splunk Enterprise instance on Windows reach out to remote Windows hosts and collect event logs or performance data over WMI, configured in wmi.conf or Splunk Web. The HTTP Event Collector, HEC, lets applications, scripts and cloud services push events to Splunk over HTTP or HTTPS using a token instead of a forwarder.

At 5%, expect about three questions. WMI questions focus on prerequisites such as the account Splunk runs as and on the trade-offs against a universal forwarder. HEC questions cover enabling the collector, tokens, the default port 8088, endpoints for JSON and raw events, and indexer acknowledgement.

How it's tested

Questions describe a source that cannot run a forwarder and ask which agentless method fits, or present a failing WMI or HEC setup and ask for the missing prerequisite. Expect settings such as the HEC port, token behaviour, endpoints and the Splunk service account requirements for WMI.

  • Choose the method

    A source is described and you decide between WMI, HEC or a forwarder based on platform and constraints.

  • Fix the prerequisite

    A WMI or HEC input is not working and you identify the missing account, permission or global setting.

  • Know the HEC details

    You recall the default port, header format, endpoints or acknowledgement behaviour for HEC.

Reasoning it through

A developer receives errors when posting JSON to https://splunk:8088/services/collector/event with a valid token. The candidate checks Global Settings and finds the HTTP Event Collector disabled for all tokens. Enabling it there fixes the problem. Creating a second token or opening port 9997 would not help, since HEC must be switched on globally before any token works.

Objectives 2

Official objectives from the Splunk outline, in outline order.

14.1 Creating Windows Management Instrumentation (WMI) inputsRemote Windows collection with wmi.conf.
What it means
WMI inputs let Splunk Enterprise running on Windows collect data from remote Windows machines without installing software on them. In Splunk Web or wmi.conf, a [WMI:<name>] stanza lists target servers, an interval, and either event_log_file for event logs or a wql query with a namespace for performance and system data.
What to understand
The Splunk service must run as a domain account with rights to query WMI on the targets, and the network must allow WMI and its RPC ports. WMI adds load on both ends and does not scale as well as universal forwarders, which are the usual recommendation for many hosts. WMI inputs are configured on a Windows Splunk instance, not on Linux.
How it shows up
A Windows host cannot run a forwarder and you configure or troubleshoot a WMI input.
Common confusion
Running Splunk as Local System and expecting it to query remote machines over WMI.
14.2 Describe HTTP Event CollectorToken-based collection over HTTP and HTTPS.
What it means
The HTTP Event Collector accepts events sent over HTTP or HTTPS, by default on port 8088. An admin enables HEC in Global Settings and creates tokens, each with a default sourcetype, default index and allowed indexes. Clients send the header Authorization: Splunk <token> to endpoints such as /services/collector/event for JSON events and /services/collector/raw for raw text.
What to understand
Tokens replace user credentials, so they can be disabled or rotated individually. Indexer acknowledgement can be enabled per token, using a channel identifier so clients can confirm events were indexed. HEC can run on indexers or heavy forwarders, often behind a load balancer, and token configuration can be distributed to several instances.
How it shows up
An application must send data without a forwarder and you configure or troubleshoot HEC.
Common confusion
Creating a token but leaving HEC disabled in Global Settings.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • WMI input

    Remote collection from Windows hosts without an agent.

    Remember
    Configured in wmi.conf or Splunk Web on Windows.
    Tested as
    Agentless Windows questions.
    Trap
    Configuring it on Linux.

  • WMI service account

    Splunk must run as a domain account with WMI rights.

    Remember
    Local System cannot query remote hosts.
    Tested as
    WMI failure scenarios.
    Trap
    Leaving the default account.

  • event_log_file and wql

    WMI stanza options for event logs or queries.

    Remember
    wql needs a namespace.
    Tested as
    Stanza questions.
    Trap
    Mixing them up.

  • WMI versus forwarder

    WMI avoids agents but scales poorly.

    Remember
    Forwarders are preferred for large fleets.
    Tested as
    Design questions.
    Trap
    Choosing WMI for thousands of hosts.

  • HTTP Event Collector

    Token-based HTTP or HTTPS input.

    Remember
    Default port 8088.
    Tested as
    HEC questions.
    Trap
    Assuming it needs a forwarder.

  • Global Settings

    Switch that enables HEC for all tokens.

    Remember
    Disabled until turned on.
    Tested as
    HEC failure scenarios.
    Trap
    Only creating tokens.

  • HEC token

    Credential carrying default index, sourcetype and allowed indexes.

    Remember
    Sent as Authorization: Splunk <token>.
    Tested as
    Configuration questions.
    Trap
    Using a username and password.

  • /services/collector/event

    Endpoint for JSON-formatted events.

    Remember
    Metadata can be set per event.
    Tested as
    Endpoint questions.
    Trap
    Sending raw text to it.

  • /services/collector/raw

    Endpoint for raw text data.

    Remember
    Parsed like other raw data.
    Tested as
    Endpoint questions.
    Trap
    Expecting JSON metadata handling.

  • HEC indexer acknowledgement

    Optional confirmation that events were indexed.

    Remember
    Uses a channel identifier.
    Tested as
    Reliability questions.
    Trap
    Assuming HTTP 200 means indexed.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Agentless options

ConceptMeaningKey differenceCommon trap
WMI input Pull from remote Windows hosts Needs domain account and RPC access Choosing it for large fleets
HTTP Event Collector Applications push events Token authentication Assuming a forwarder is needed
Universal forwarder Agent on the source Scales best Treating it as agentless

HEC endpoints

ConceptMeaningKey differenceCommon trap
/services/collector/event JSON events Per-event metadata Sending plain text
/services/collector/raw Raw text Standard parsing applies Expecting JSON fields
/services/collector/health Health check No data indexed Using it to send events

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Token alone is enough

    What candidates pick
    Create a token and start sending.
    Why it looks right
    Tokens look like the only requirement.
    Why it's wrong
    HEC must also be enabled in Global Settings before any token accepts data.

    Clue to watch for All HEC requests fail despite valid tokens.

  2. Local System for WMI

    What candidates pick
    Leave Splunk running as Local System for WMI.
    Why it looks right
    It is the default service account.
    Why it's wrong
    Remote WMI queries need a domain account with permissions on the targets.

    Clue to watch for Access denied errors appear for remote hosts.

  3. WMI for every host

    What candidates pick
    Use WMI to collect from thousands of Windows servers.
    Why it looks right
    No agent install is needed.
    Why it's wrong
    WMI adds load and scales poorly; universal forwarders are the recommended approach.

    Clue to watch for The fleet is large.

  4. HEC on 9997

    What candidates pick
    Point HEC clients at port 9997.
    Why it looks right
    9997 is Splunk's familiar receiving port.
    Why it's wrong
    HEC listens on 8088 by default; 9997 is for forwarders.

    Clue to watch for Clients use HTTP or HTTPS.

  5. 200 means indexed

    What candidates pick
    Treat a successful HTTP response as delivery confirmation.
    Why it looks right
    HTTP success sounds final.
    Why it's wrong
    Without indexer acknowledgement, a 200 only means HEC received the request.

    Clue to watch for The requirement is confirmed indexing.

Answer framework

Use these steps to answer agentless input questions quickly and accurately.

  1. Decide whether the source is a Windows host that cannot run an agent, an application that can send HTTP requests, or something better served by a forwarder.
  2. For Windows, configure a WMI input on a Windows Splunk instance running as a domain account with WMI and RPC access to the targets.
  3. Limit WMI to small numbers of hosts and recommend universal forwarders when the fleet is large or performance matters.
  4. For applications, enable HEC in Global Settings, create a token with default and allowed indexes, and use port 8088 over HTTPS.
  5. Choose the event or raw endpoint to match the payload, and enable indexer acknowledgement with channels when delivery must be confirmed.

Practice question

A development team runs a serverless function that cannot host a forwarder and needs to send JSON events to Splunk over HTTPS. Which configuration should the Splunk admin provide?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Spend most of your time on the HTTP Event Collector, because it is easy to practise and appears often, and the remainder on WMI concepts. In a lab, open Settings, Data inputs, HTTP Event Collector, enable it in Global Settings and create a token with a default index. Use curl to post a JSON event to /services/collector/event with the Authorization header, then send plain text to /services/collector/raw and compare the results in search. Disable HEC globally and resend to see the failure.

Try enabling indexer acknowledgement on the token and note that requests now require a channel. Read the HEC section of the Getting Data In manual for the list of endpoints and status codes.

For WMI, a Windows lab is ideal but not required. Read the wmi.conf specification and the prerequisites for remote WMI, and summarise them on a card: Windows Splunk instance, domain account, permissions, firewall rules and scaling limits. Finish with questions that ask you to choose between WMI, HEC and forwarders for described sources.

FAQ

How much of SPLK-1003 is Agentless Inputs?

Agentless Inputs is 5% of the exam, about three questions, covering WMI inputs and the HTTP Event Collector.

What is the default HEC port?

8088. Clients send requests over HTTP or HTTPS with the header Authorization: Splunk followed by the token.

Why does HEC reject requests with a valid token?

HEC may be disabled in Global Settings, or the token itself may be disabled or restricted to other indexes.

What account does Splunk need for WMI?

A domain account with permission to query WMI on the remote hosts. The default Local System account cannot do this.

Should I use WMI for all Windows servers?

Usually not. WMI suits a small number of hosts; universal forwarders scale better and add less load.

How do I confirm HEC events were indexed?

Enable indexer acknowledgement on the token, send a channel identifier and query the acknowledgement endpoint for the returned IDs.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 14 knowledge

You have covered WMI inputs and the HTTP Event Collector. Test whether you can pick the right agentless method and fix common setup failures.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going