SPLK-1003 · Domain 15 of 17

SPLK-1003 Domain 15: Fine Tuning Inputs

Fine Tuning Inputs explains what Splunk does to data in the input phase before parsing begins, and how admins adjust it, especially sourcetype assignment and character set encoding, using props.conf on the instance that first reads the data.

Exam weight
5%
Official objectives
2
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 9 min read Reviewed October 2026

Overview

Domain 15 has two official objectives: understand the default processing that occurs during the input phase, and configure input phase options, such as sourcetype fine-tuning and character set encoding. In the input phase Splunk reads data in blocks, attaches source, host and sourcetype metadata along with the target index, and converts text to UTF-8 using the configured character set. It does not yet break events or find timestamps.

Sourcetype fine-tuning means controlling how a sourcetype is chosen, either explicitly in inputs.conf or through props.conf rules keyed on source, so that later parsing settings apply correctly. CHARSET in props.conf tells Splunk which encoding to expect. At 5%, plan for about three questions, often about precedence of sourcetype assignment and where input-phase props.conf settings must be placed.

How it's tested

Expect troubleshooting and placement questions. Data from a source receives the wrong sourcetype or shows garbled characters, and you choose the props.conf or inputs.conf change and the instance where it belongs. Other items test the order in which Splunk decides a sourcetype when several rules could apply.

  • Which sourcetype wins

    Several assignment methods could apply and you decide which one Splunk uses for the data.

  • Where does it go

    You choose whether an input-phase setting belongs on the universal forwarder, a heavy forwarder or the indexer.

  • Fix the encoding

    Characters appear garbled and you select the CHARSET setting that corrects the conversion to UTF-8.

Reasoning it through

Logs from a Japanese application show garbled text. They are encoded in Shift-JIS and collected by a universal forwarder. Character set conversion happens in the input phase, so the candidate adds CHARSET = SHIFT-JIS in props.conf under that sourcetype on the universal forwarder. Placing it only on the indexers would not work because the forwarder already performed the input phase.

Objectives 2

Official objectives from the Splunk outline, in outline order.

15.1 Understand the default processing that occurs during input phaseMetadata assignment and encoding in the input phase.
What it means
During the input phase Splunk acquires data from files, network ports, scripts and other inputs, reads it in blocks, and annotates each block with host, source, sourcetype and index. It applies character set conversion to UTF-8 and, for monitored files, tracks progress in the fishbucket. Event breaking and timestamp extraction wait until the parsing phase.
What to understand
Unless set explicitly, sourcetype is chosen automatically: Splunk checks source-based rules, then rule-based matching, then automatic learning from the data's appearance. Because universal forwarders perform the input phase, any input-phase configuration must be on them for forwarded data. Data then leaves the forwarder as unparsed blocks with metadata attached.
How it shows up
A task is named and you decide whether it happens in the input phase by default.
Common confusion
Assuming line breaking and timestamp assignment already happen in the input phase.
15.2 Configure input phase options, such as sourcetype fine-tuning and character set encodingSourcetype rules and CHARSET in props.conf.
What it means
To control sourcetype, set it explicitly in the inputs.conf stanza, or add a props.conf stanza such as [source::/var/log/app/*.log] with sourcetype = app_log to override by source. To control encoding, set CHARSET in props.conf, for example CHARSET = UTF-16LE or CHARSET = AUTO, under the sourcetype, source or host stanza.
What to understand
An explicit sourcetype in inputs.conf takes precedence over automatic assignment. Source-based props.conf rules are applied in the input phase, so they must be on the instance performing it. Prefer explicit sourcetypes to automatic learning, which can create many unstable sourcetypes such as name-too_small. Restart the instance after changing input-phase props.conf.
How it shows up
Data has the wrong sourcetype or encoding and you choose the setting and placement.
Common confusion
Putting source-based sourcetype overrides only on the indexers when a universal forwarder reads the data.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Input phase tasks

    Acquire data, add metadata and convert encoding.

    Remember
    No event breaking yet.
    Tested as
    Phase questions.
    Trap
    Including timestamps here.

  • Metadata on blocks

    host, source, sourcetype and index travel with the data.

    Remember
    Set before parsing.
    Tested as
    Metadata questions.
    Trap
    Thinking indexers assign source.

  • Explicit sourcetype

    sourcetype set in the inputs.conf stanza.

    Remember
    Most predictable choice.
    Tested as
    Precedence questions.
    Trap
    Relying on auto-learning.

  • [source::<path>] stanza

    props.conf rule keyed on source.

    Remember
    Can set sourcetype in the input phase.
    Tested as
    Override questions.
    Trap
    Placing it only on indexers.

  • Rule-based assignment

    Splunk matches data against rule stanzas.

    Remember
    Used when no explicit or source rule applies.
    Tested as
    Precedence questions.
    Trap
    Thinking it overrides explicit settings.

  • Auto-learned sourcetype

    Splunk guesses from data patterns.

    Remember
    Can produce names such as name-too_small.
    Tested as
    Troubleshooting questions.
    Trap
    Treating it as a best practice.

  • CHARSET

    props.conf setting for source encoding.

    Remember
    AUTO lets Splunk try to detect it.
    Tested as
    Garbled character scenarios.
    Trap
    Assuming UTF-8 everywhere.

  • UTF-8 default

    Splunk converts input to UTF-8.

    Remember
    Wrong source encoding garbles text.
    Tested as
    Encoding questions.
    Trap
    Fixing encoding at search time.

  • Placement on the UF

    Input-phase props.conf belongs on the first instance reading data.

    Remember
    Often the universal forwarder.
    Tested as
    Placement questions.
    Trap
    Configuring only the indexers.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Sourcetype assignment order

ConceptMeaningKey differenceCommon trap
Explicit in inputs.conf Set on the input stanza Highest precedence Expecting props rules to beat it
Source-based props.conf [source::] rule Applied when no explicit value Placing it on indexers only
Rule-based Pattern rules Fallback matching Thinking it is always used
Auto-learned Guessed from data Last resort Relying on it in production

Input phase versus parsing phase settings

ConceptMeaningKey differenceCommon trap
CHARSET Encoding conversion Input phase Placing it with parsing settings
Source sourcetype override Assign sourcetype by path Input phase Expecting indexers to apply it
LINE_BREAKER, TIME_FORMAT Event and time handling Parsing phase Placing them on a UF

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Indexer handles CHARSET

    What candidates pick
    Set CHARSET only on the indexers for forwarded data.
    Why it looks right
    Indexers handle most props.conf settings.
    Why it's wrong
    Encoding conversion is an input-phase task performed by the universal forwarder.

    Clue to watch for A universal forwarder reads the file.

  2. Props beats explicit

    What candidates pick
    Expect a source-based props rule to override an explicit inputs.conf sourcetype.
    Why it looks right
    props.conf seems more specific.
    Why it's wrong
    An explicit sourcetype on the input takes precedence over automatic and source-based assignment.

    Clue to watch for The input stanza already sets sourcetype.

  3. Timestamps at input

    What candidates pick
    Place TIME_FORMAT with the input-phase settings on a UF.
    Why it looks right
    Timestamps feel like metadata.
    Why it's wrong
    Timestamp extraction belongs to parsing, on heavy forwarders or indexers.

    Clue to watch for The setting relates to event time.

  4. Auto-learning is fine

    What candidates pick
    Leave sourcetype to automatic learning.
    Why it looks right
    It works without configuration.
    Why it's wrong
    Learned sourcetypes are unstable and can produce names like name-too_small.

    Clue to watch for Search shows unexpected sourcetypes.

  5. Fix at search time

    What candidates pick
    Correct garbled characters with a search-time command.
    Why it looks right
    Search can transform output.
    Why it's wrong
    The text was already converted incorrectly at input; CHARSET must be fixed before indexing.

    Clue to watch for Characters are wrong in the stored events.

Answer framework

Use these steps for any question about input-phase behaviour in Splunk.

  1. Confirm the task belongs to the input phase, meaning metadata assignment or character set conversion, rather than parsing tasks like line breaking or timestamps.
  2. Find the first Splunk instance that reads the data, usually a universal forwarder, because input-phase props.conf settings must be placed on it.
  3. For sourcetype problems, check for an explicit inputs.conf value first, then source-based props.conf rules, then rule-based and auto-learned assignment.
  4. For encoding problems, set CHARSET for the sourcetype, source or host stanza, using a specific encoding when it is known rather than AUTO.
  5. Restart the instance after editing props.conf, then verify new events only, since already indexed data is not reprocessed.

Practice question

A universal forwarder monitors /opt/app/logs/*.log with no sourcetype in the inputs.conf stanza. Events appear with several auto-learned sourcetypes. The admin adds [source::/opt/app/logs/*.log] with sourcetype = app_log to props.conf on the indexers, but nothing changes. Why?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Anchor this topic to the pipeline diagram from Getting Data In – Staging. Highlight the input phase and list only its tasks: reading data, metadata and encoding. Then write the sourcetype precedence order beside it and the rule that input-phase props.conf belongs on the first instance that reads the data.

In a lab with a universal forwarder and an indexer, monitor a directory without setting sourcetype and observe what Splunk chooses. Add a source-based props.conf rule on the indexer only and confirm nothing changes, then move it to the forwarder and restart. Create a UTF-16 or Shift-JIS test file, index it without CHARSET, and fix the garbled output by setting CHARSET on the forwarder.

After the lab, compare input-phase settings with the parsing settings covered in the next topic so you can place each attribute correctly. Practise with scenario questions that mix placement and precedence, and check every answer by asking which instance performed the input phase.

FAQ

How much of SPLK-1003 is Fine Tuning Inputs?

Fine Tuning Inputs is 5% of the exam, about three questions, covering default input processing and input phase options.

What happens in the input phase?

Splunk reads data, attaches host, source, sourcetype and index, and converts the character set to UTF-8. Events are not yet broken or timestamped.

Which sourcetype assignment wins?

An explicit sourcetype in inputs.conf. Without one, Splunk uses source-based props.conf rules, then rule-based matching, then automatic learning.

Where do input-phase props.conf settings go?

On the first Splunk instance that reads the data, which for forwarded data is usually the universal forwarder.

How do I fix garbled characters?

Set CHARSET in props.conf for that source or sourcetype to the file's real encoding, on the instance performing the input phase.

Will fixing CHARSET correct old events?

No. Settings apply to newly indexed data. Already stored events keep their original conversion.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 15 knowledge

You have studied input phase processing, sourcetype fine-tuning and character set encoding. Test whether you can place each setting on the right instance.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going