SPLK-1003 · Domain 10 of 17

SPLK-1003 Domain 10: Configuring Forwarders

Configuring Forwarders goes beyond a basic outputs.conf: automatic load balancing across indexers, indexer acknowledgement to protect data in transit, compression and SSL, throughput limits, indexer discovery and intermediate forwarding tiers.

Exam weight
5%
Official objectives
2
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 8 min read Reviewed October 2026

Overview

Domain 10 has two official objectives: configure forwarders and identify additional forwarder options. Configuring forwarders covers outputs.conf target groups, default groups and the settings that decide how a forwarder spreads data across several indexers. Additional options cover indexer acknowledgement with useACK, compression, SSL encryption, the forwarder's output queue, throughput limits in limits.conf, indexer discovery through a cluster manager, intermediate forwarders and sending to more than one group.

At 5%, expect about three questions. They usually describe a reliability, security or performance requirement and ask which forwarder setting satisfies it, so you should be able to connect each option to the problem it solves and to the file where it lives.

How it's tested

Expect requirement-to-setting questions. A forwarder is losing data during indexer restarts, sending unevenly, or transmitting in clear text, and you choose the outputs.conf, inputs.conf or limits.conf change that addresses it. Several options look plausible, so tie each one to the exact problem it was designed to solve.

  • Protect the data

    A data loss or delivery guarantee concern is described and you choose indexer acknowledgement or queue settings.

  • Spread the load

    Indexers fill unevenly and you choose load-balancing settings such as autoLBFrequency or a longer server list.

  • Secure or tune

    You select SSL, compression or throughput settings and decide where each must be configured.

Reasoning it through

A universal forwarder on a busy web server lags hours behind real time while CPU and network are idle. The candidate recalls that universal forwarders cap throughput at 256 KBps by default through maxKBps in limits.conf. Raising or removing that limit fixes the lag, while adding indexers or enabling compression would not address the bottleneck on the forwarder.

Objectives 2

Official objectives from the Splunk outline, in outline order.

10.1 Configure Forwardersoutputs.conf target groups and load balancing.
What it means
A forwarder's outputs.conf defines one or more target groups. The [tcpout] stanza sets defaultGroup, and each [tcpout:<group>] stanza lists server = idx1:9997, idx2:9997. With several servers, the forwarder uses automatic load balancing, switching indexers on a timer set by autoLBFrequency, which defaults to 30 seconds, or after a volume set by autoLBVolume.
What to understand
Load balancing spreads data so every indexer holds part of each source, which speeds distributed search. Universal forwarders switch indexers only at safe points in the stream, so a single long-lived file can stick to one indexer; event breaking settings on the forwarder can help. Configuration can be applied through the CLI, files or a deployment server.
How it shows up
A distribution or connectivity requirement is given and you choose the outputs.conf configuration.
Common confusion
Assuming load balancing sends each event to every listed indexer rather than switching between them.
10.2 Identify additional Forwarder optionsAcknowledgement, compression, SSL, throughput and indexer discovery.
What it means
Additional options include useACK = true for indexer acknowledgement, so the forwarder resends data the indexer has not confirmed; compressed = true for compression, set on both forwarder and receiver; SSL settings for encrypted, authenticated connections; maxQueueSize for the output queue; maxKBps under [thruput] in limits.conf; indexer discovery so forwarders get the peer list from a cluster manager; and intermediate forwarders that aggregate traffic.
What to understand
Each option solves a specific problem: acknowledgement for data loss in transit, compression for bandwidth, SSL for confidentiality, maxKBps for throughput caps, indexer discovery for changing cluster membership. Forwarders can also send to several groups at once, cloning data, or send raw data to third-party systems with sendCookedData = false.
How it shows up
A reliability, security or performance need is described and you pick the matching forwarder option.
Common confusion
Setting compression on the forwarder only, without enabling it on the receiving port.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • defaultGroup

    The target group a forwarder uses unless told otherwise.

    Remember
    Set in the [tcpout] stanza.
    Tested as
    outputs.conf questions.
    Trap
    Leaving it unset with several groups.

  • Automatic load balancing

    Forwarder switches among listed indexers.

    Remember
    autoLBFrequency defaults to 30 seconds.
    Tested as
    Distribution questions.
    Trap
    Thinking every event goes to every indexer.

  • autoLBVolume

    Switch indexers after a data volume threshold.

    Remember
    Complements the time-based switch.
    Tested as
    Uneven distribution items.
    Trap
    Confusing it with maxKBps.

  • useACK

    Indexer acknowledgement for forwarded data.

    Remember
    Forwarder resends unacknowledged blocks.
    Tested as
    Data loss questions.
    Trap
    Assuming TCP alone guarantees delivery.

  • compressed = true

    Compresses forwarded data.

    Remember
    Must match on both forwarder and receiver.
    Tested as
    Bandwidth questions.
    Trap
    Setting one side only.

  • SSL forwarding

    Encrypts and can authenticate forwarder connections.

    Remember
    Certificates configured on both sides.
    Tested as
    Security questions.
    Trap
    Relying on compression for confidentiality.

  • maxKBps

    Throughput cap in limits.conf [thruput].

    Remember
    Universal forwarder default is 256 KBps.
    Tested as
    Lagging forwarder scenarios.
    Trap
    Adding indexers to fix forwarder lag.

  • Indexer discovery

    Forwarders learn indexer peers from the cluster manager.

    Remember
    Avoids editing server lists.
    Tested as
    Clustered environments.
    Trap
    Hard-coding peers that change.

  • Intermediate forwarder

    A forwarder tier that receives and relays data.

    Remember
    Reduces direct connections to indexers.
    Tested as
    Architecture questions.
    Trap
    Assuming it must parse.

  • Cloned groups

    Sending the same data to several target groups.

    Remember
    List groups in defaultGroup separated by commas.
    Tested as
    Dual-destination questions.
    Trap
    Thinking it load-balances between groups.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Forwarder options by problem

ConceptMeaningKey differenceCommon trap
useACK Delivery confirmation Prevents loss in transit Assuming TCP suffices
compressed Smaller transfers Both sides must agree Setting one side
SSL Encrypted connection Protects confidentiality Using compression instead
maxKBps Throughput cap UF default 256 KBps Blaming indexers

Distribution patterns

ConceptMeaningKey differenceCommon trap
Load-balanced group Several servers in one group Data split across them Expecting copies on each
Cloned groups Several groups in defaultGroup Full copy to each group Expecting load balancing
Indexer discovery Peers from cluster manager Dynamic server list Hard-coding cluster peers

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Load balancing copies data

    What candidates pick
    Say each listed indexer receives every event.
    Why it looks right
    Several servers are listed together.
    Why it's wrong
    Within one group the forwarder switches between servers; cloning needs separate groups.

    Clue to watch for One tcpout group lists several indexers.

  2. Add indexers for lag

    What candidates pick
    Add indexers to fix a lagging forwarder.
    Why it looks right
    More capacity sounds helpful.
    Why it's wrong
    If the forwarder is capped by maxKBps, extra indexers change nothing.

    Clue to watch for Forwarder resources are idle while data lags.

  3. TCP guarantees delivery

    What candidates pick
    Skip useACK because TCP is reliable.
    Why it looks right
    TCP retransmits lost packets.
    Why it's wrong
    Data can be lost in memory if an indexer fails before writing it; acknowledgement covers that gap.

    Clue to watch for The requirement is no data loss during outages.

  4. Compression secures data

    What candidates pick
    Choose compression to protect data in transit.
    Why it looks right
    Compressed data is not human readable.
    Why it's wrong
    Compression saves bandwidth; SSL provides encryption.

    Clue to watch for The requirement mentions confidentiality.

  5. Hard-code cluster peers

    What candidates pick
    List every clustered indexer manually in outputs.conf.
    Why it looks right
    It works for small sites.
    Why it's wrong
    Indexer discovery lets forwarders follow cluster membership automatically.

    Clue to watch for Indexers join and leave a cluster.

Answer framework

Use these steps to choose the right forwarder setting for a requirement.

  1. Classify the requirement as distribution, reliability, security, bandwidth or throughput so you can focus on the relevant group of forwarder settings and files.
  2. For distribution, list several indexers in one tcpout group and adjust autoLBFrequency or autoLBVolume when indexers fill unevenly.
  3. For reliability, enable useACK and size the output queue; for security, configure SSL certificates on both forwarder and receiver.
  4. For bandwidth, enable compression on both ends; for a lagging forwarder, check maxKBps in limits.conf before blaming the indexers or the network.
  5. For changing clusters or extra destinations, use indexer discovery, intermediate forwarders or cloned target groups as the scenario requires.

Practice question

A security team requires that no forwarded events are lost if an indexer crashes after receiving data but before writing it to disk. Which setting should the admin enable in the forwarders' outputs.conf?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Learn forwarder options as a problem-to-setting table. List problems down the left, such as uneven indexers, data loss, clear-text traffic, bandwidth limits, forwarder lag, changing cluster membership and a second destination, and write the setting and file next to each. Review the table until you can answer from the problem alone.

In a lab, configure a universal forwarder with two indexers in one group and watch data split between them in a search by splunk_server. Enable useACK and compression, remembering to set compression on the indexer's splunktcp stanza too. Then lower maxKBps and watch the forwarder fall behind, which makes the throughput trap memorable.

Afterwards, read the outputs.conf specification file and skim each attribute you used. Finish with scenario questions, and link this topic to Forwarder Management, since in practice you would push these settings through a deployment app rather than editing each forwarder by hand, and that habit is exactly what the exam expects you to recommend.

FAQ

How much of SPLK-1003 is Configuring Forwarders?

Configuring Forwarders is 5% of the exam, about three questions, covering forwarder configuration and additional forwarder options.

How does forwarder load balancing work?

The forwarder sends to one indexer at a time from its target group and switches every autoLBFrequency seconds, 30 by default, or after autoLBVolume bytes.

What does useACK do?

It makes the indexer acknowledge data once written; the forwarder resends anything not acknowledged, protecting against loss in transit.

Why is my universal forwarder lagging?

Check maxKBps in limits.conf. The universal forwarder defaults to 256 KBps, which can be too low for busy sources.

Does compression need settings on both sides?

Yes. Set compressed = true in outputs.conf on the forwarder and on the receiving splunktcp input on the indexer.

What is indexer discovery?

A feature that lets forwarders ask the cluster manager for the current list of indexer peers instead of hard-coding them.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 10 knowledge

You have covered outputs.conf groups, load balancing and additional forwarder options. Test whether you can match a requirement to the right setting.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going