SPLK-1003 · Domain 11 of 17

SPLK-1003 Domain 11: Forwarder Management

Forwarder Management, a 10% topic, covers using a deployment server to manage many Splunk instances: building deployment apps, grouping clients into server classes, configuring deployment clients to phone home, and monitoring what was deployed.

Exam weight
10%
Official objectives
6
Estimated questions estimate
~6
Suggested study time estimate
6–9 hrs

About 11 min read Reviewed October 2026

Overview

Domain 11 has six official objectives: explain the use of deployment management, describe the Splunk deployment server, manage forwarders using deployment apps, configure deployment clients, configure client groups and monitor forwarder management activities. Together they describe how one Splunk Enterprise instance, the deployment server, holds apps in etc/deployment-apps and serves them to deployment clients according to server classes defined in serverclass.conf.

At 10%, expect about six questions, more than most topics. Questions cover the pull model where clients poll the server, include and exclude filters, whether an app triggers a client restart, the deploymentclient.conf settings, and how to confirm deployment status in the Forwarder Management interface. In Splunk Enterprise 10 this interface is presented as Agent Management, but the deployment server concepts are the same.

How it's tested

Scenarios describe a fleet of forwarders and a configuration change, then ask how to package, target or deliver it, or why a client did not receive it. Others test deploymentclient.conf settings and where to check deployment status after a change has been made.

  • Package and place

    You decide how to build a deployment app and where on the deployment server it must be stored.

  • Target with server classes

    A subset of clients must receive an app and you choose include and exclude filters in a server class.

  • Troubleshoot delivery

    A client has not received an app and you find the cause, such as no reload, a filter mismatch or a wrong target URI.

Reasoning it through

A new app placed in etc/deployment-apps is not reaching Linux forwarders. The server class include filter matches their hostnames, and clients are phoning home. The candidate realises the deployment server has not been told about the change, so running splunk reload deploy-server, or saving the server class in the interface, makes the app available at the next poll.

Objectives 6

Official objectives from the Splunk outline, in outline order.

11.1 Explain the use of deployment managementWhy central configuration distribution is used.
What it means
Deployment management lets an admin maintain configuration for many Splunk instances from one place. Configuration is packaged as apps and assigned to groups of instances, so every forwarder in a group gets the same inputs, outputs and props settings. This reduces manual errors and makes changes repeatable.
What to understand
The deployment server suits universal and heavy forwarders and standalone instances. It should not manage indexer cluster peers, which use the cluster manager, or search head cluster members, which use the deployer. Other tools such as configuration management systems can also be used, but the deployment server is Splunk's built-in option.
How it shows up
A scenario describes managing many instances and you decide whether a deployment server is appropriate.
Common confusion
Using the deployment server to manage indexer cluster peers or search head cluster members.
11.2 Describe Splunk Deployment ServerThe server role, its directories and the pull model.
What it means
A deployment server is a Splunk Enterprise instance that stores deployment apps in $SPLUNK_HOME/etc/deployment-apps and defines server classes in serverclass.conf. Clients poll it, known as phoning home, on a set interval. The server compares the client's apps with what its server classes assign and the client downloads any changes.
What to understand
The deployment server does not push unsolicited; delivery happens at the next phone home. After editing apps or serverclass.conf outside the interface, run splunk reload deploy-server. One deployment server can manage thousands of clients, and large fleets may need a dedicated instance.
How it shows up
You describe how and when a client receives an updated app from the deployment server.
Common confusion
Placing deployment apps in etc/apps on the deployment server instead of etc/deployment-apps.
11.3 Manage forwarders using deployment appsBuilding and updating apps for clients.
What it means
A deployment app is a normal Splunk app directory, typically containing local or default inputs.conf, outputs.conf or props.conf, placed in etc/deployment-apps. Server classes map apps to clients, and each app mapping can specify whether the client restarts Splunk after receiving it.
What to understand
Keep apps small and purpose-specific, such as one for outputs and one per data source, so they can be combined per server class. Changes made on a client to a deployed app are overwritten at the next sync. Apps that change inputs or outputs usually need restartSplunkd enabled for clients to apply them.
How it shows up
A change must reach some forwarders and you choose how to structure and deliver the app.
Common confusion
Editing a deployed app directly on a client and expecting the change to persist.
11.4 Configure deployment clientsdeploymentclient.conf and phoning home.
What it means
An instance becomes a deployment client through deploymentclient.conf, with a [target-broker:deploymentServer] stanza setting targetUri = ds.example.com:8089, or with the CLI command splunk set deploy-poll ds.example.com:8089 followed by a restart. phoneHomeIntervalInSecs controls how often the client polls.
What to understand
Clients connect to the deployment server's management port, 8089 by default. The setting is often included in the forwarder's initial installation so it reports in immediately. A client identifies itself by attributes such as hostname, IP address, client name and machine type, which server classes use to match it.
How it shows up
You choose the file, stanza or command that points a forwarder at the deployment server.
Common confusion
Pointing targetUri at the receiving port 9997 instead of the management port.
11.5 Configure client groupsServer classes with include and exclude filters.
What it means
Client groups are server classes. Each server class has include and exclude filters, such as whitelist.0 = web* and blacklist.0 = web-test*, matching hostnames, IP addresses, DNS names or client names, plus an optional machine type filter such as linux-x86_64. Apps are then assigned to the server class.
What to understand
Exclude filters take precedence over include filters by default. A client can belong to several server classes and receives every app those classes assign. Server classes can be created in the forwarder management interface or directly in serverclass.conf.
How it shows up
A subset of clients must be targeted and you choose the filters that match them correctly.
Common confusion
Assuming include filters override exclude filters when a client matches both.
11.6 Monitor forwarder management activitiesChecking client status and deployment results.
What it means
The forwarder management interface on the deployment server lists clients, when each last phoned home, which server classes and apps apply to it and whether deployment succeeded. The Monitoring Console's forwarder dashboards and internal logs, such as splunkd.log entries from the deployment components, add detail.
What to understand
Use splunk list deploy-clients on the server and splunk show deploy-poll on a client to confirm settings. A client that stops phoning home may be down or blocked on port 8089. Logs on both sides record downloads, failures and restarts.
How it shows up
You choose where to confirm that a client received an app or why it did not.
Common confusion
Expecting deployment status to appear in the indexers' license reports.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Deployment server

    Instance that serves apps to deployment clients.

    Remember
    Clients pull on a schedule.
    Tested as
    Role questions.
    Trap
    Thinking it pushes immediately.

  • etc/deployment-apps

    Where deployment apps live on the server.

    Remember
    Not etc/apps.
    Tested as
    Placement questions.
    Trap
    Placing apps in etc/apps.

  • serverclass.conf

    Defines server classes, filters and app mappings.

    Remember
    Created by the interface or by hand.
    Tested as
    Configuration questions.
    Trap
    Putting filters in deploymentclient.conf.

  • Server class

    A group of clients with assigned apps.

    Remember
    Clients can belong to several.
    Tested as
    Targeting questions.
    Trap
    Thinking membership is exclusive.

  • Include and exclude filters

    Match clients by name, IP or DNS.

    Remember
    Exclude wins over include by default.
    Tested as
    Filter questions.
    Trap
    Assuming include wins.

  • Machine type filter

    Matches clients by platform.

    Remember
    Useful for Windows versus Linux apps.
    Tested as
    Mixed-fleet questions.
    Trap
    Matching only by hostname.

  • deploymentclient.conf

    Client file with the targetUri.

    Remember
    Uses management port 8089.
    Tested as
    Client configuration.
    Trap
    Using port 9997.

  • splunk set deploy-poll

    CLI command that sets the deployment server.

    Remember
    Restart the client after.
    Tested as
    CLI questions.
    Trap
    Running it on the server.

  • splunk reload deploy-server

    Makes the server reread apps and classes.

    Remember
    Needed after editing files directly.
    Tested as
    Missing update scenarios.
    Trap
    Restarting every client instead.

  • restartSplunkd

    App setting that restarts clients after deployment.

    Remember
    Needed for inputs and outputs changes.
    Tested as
    Apps not taking effect.
    Trap
    Leaving it off for input changes.

  • Phone home

    Client polling of the deployment server.

    Remember
    Interval set by phoneHomeIntervalInSecs.
    Tested as
    Timing questions.
    Trap
    Expecting instant delivery.

  • Agent Management

    Splunk Enterprise 10 name for the forwarder management interface.

    Remember
    Same deployment server concepts.
    Tested as
    Terminology recognition.
    Trap
    Thinking it replaces server classes.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Configuration distribution tools

ConceptMeaningKey differenceCommon trap
Deployment server Apps to clients Forwarders and standalone instances Using it for cluster peers
Cluster manager Bundles to indexer peers Indexer clusters only Using it for forwarders
Deployer Bundles to SHC members Search head clusters only Using it for forwarders

Server and client files

ConceptMeaningKey differenceCommon trap
serverclass.conf Server classes and app mappings On the deployment server Placing it on clients
deploymentclient.conf Server address and polling On each client Placing filters here
etc/deployment-apps App repository On the deployment server Using etc/apps

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Server pushes

    What candidates pick
    Expect clients to receive an app the moment it is saved.
    Why it looks right
    Central management sounds like push.
    Why it's wrong
    Clients pull changes at their next phone home interval.

    Clue to watch for The question asks when the client gets the change.

  2. Wrong app directory

    What candidates pick
    Put the deployment app in etc/apps on the server.
    Why it looks right
    That is where apps normally live.
    Why it's wrong
    The deployment server serves apps only from etc/deployment-apps.

    Clue to watch for The app never appears in the interface.

  3. Include beats exclude

    What candidates pick
    Expect a host matching both filters to get the app.
    Why it looks right
    It was explicitly included.
    Why it's wrong
    By default the exclude filter takes precedence.

    Clue to watch for A host matches both filters.

  4. Port 9997 for clients

    What candidates pick
    Set targetUri to the indexer receiving port.
    Why it looks right
    9997 is the familiar forwarding port.
    Why it's wrong
    Deployment clients contact the deployment server's management port, 8089 by default.

    Clue to watch for The client cannot reach the deployment server.

  5. Local edits persist

    What candidates pick
    Fix a setting by editing the deployed app on the forwarder.
    Why it looks right
    It is the quickest change.
    Why it's wrong
    The next sync replaces the client copy with the server version.

    Clue to watch for The fix disappears after some time.

  6. Manage cluster peers

    What candidates pick
    Use the deployment server to update indexer cluster peers.
    Why it looks right
    It manages other instances.
    Why it's wrong
    Indexer cluster peers receive configuration bundles from the cluster manager.

    Clue to watch for The targets are clustered indexers.

Answer framework

Walk through these steps for any deployment server scenario.

  1. Confirm the targets are forwarders or standalone instances, not indexer cluster peers or search head cluster members, which have their own tools.
  2. Package the change as a small deployment app in etc/deployment-apps on the deployment server, with restartSplunkd set when inputs or outputs change.
  3. Define or update a server class with include, exclude and machine type filters, remembering exclude wins by default.
  4. Make sure each client has a deploymentclient.conf targetUri pointing at the server's management port, and reload the server after file edits.
  5. Verify in the forwarder management interface, or Agent Management in Splunk 10, and with splunk list deploy-clients and internal logs.

Practice question

An admin adds a new app to etc/deployment-apps and maps it to a server class by editing serverclass.conf directly. Clients in the class continue phoning home, but none receive the app after an hour. What is the most likely fix?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Give this topic about twice the time of a 5% topic and do it hands on. Set up one Splunk Enterprise instance as a deployment server and two universal forwarders as clients, using splunk set deploy-poll. Create two deployment apps, one with outputs.conf and one with a monitor input, and build a server class that targets only one forwarder.

Watch the forwarder management interface as clients phone home, then edit serverclass.conf by hand and see that nothing changes until you reload the deployment server. Add an exclude filter that overlaps the include filter to see which wins, and enable restartSplunkd on the inputs app to see the client restart in its logs.

After the lab, write a one-page summary of the server-side and client-side files and their key settings, and a list of what the deployment server must never manage. Finish with scenario practice on delivery failures, since troubleshooting questions are the most common style in this topic.

FAQ

How much of SPLK-1003 is Forwarder Management?

Forwarder Management is 10% of the exam, about six questions, and has six official objectives.

Does the deployment server push apps to clients?

No. Clients phone home on an interval and download any apps their server classes assign that have changed.

Where do deployment apps go?

In $SPLUNK_HOME/etc/deployment-apps on the deployment server, not in etc/apps.

Which port do deployment clients use?

The deployment server's management port, 8089 by default, set in targetUri in deploymentclient.conf.

What happens if a host matches include and exclude filters?

By default the exclude filter wins, so the host does not join that server class.

Can the deployment server manage indexer cluster peers?

No. Indexer cluster peers get configuration from the cluster manager, and search head cluster members from the deployer.

What is Agent Management?

The name Splunk Enterprise 10 uses for the forwarder management interface. It manages deployment clients with the same server class model.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 11 knowledge

You have covered deployment apps, server classes, client configuration and monitoring. Test whether you can diagnose why a forwarder missed an update.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going