SPLK-1003 · Domain 7 of 17

SPLK-1003 Domain 7: Getting Data In

Getting Data In introduces how data enters Splunk: the metadata every input sets, the universal and heavy forwarder types, the outputs and receiving configuration that connect forwarders to indexers, and CLI commands that add inputs on a universal forwarder.

Exam weight
5%
Official objectives
4
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 10 min read Reviewed October 2026

Overview

Domain 7 has four official objectives: describe the basic settings for an input, list Splunk forwarder types, configure the forwarder and add an input to a universal forwarder using the CLI. Basic settings are the default metadata fields host, source, sourcetype and index, which every input assigns. Forwarder types are the universal forwarder and the heavy forwarder, with the light forwarder now deprecated. Configuring the forwarder means enabling receiving on the indexer and pointing outputs.conf on the forwarder at it.

At 5%, plan for about three questions. The CLI objective is practical: commands such as splunk add forward-server and splunk add monitor appear in answer options, and you should know what each writes and where. This topic is the entry point for the larger input topics that follow.

How it's tested

Expect practical configuration items: a forwarder is not sending data and you identify the missing setting, or you choose the CLI command or file that adds an input or a receiving indexer. Some items ask which metadata value an event receives by default.

  • Missing link

    Forwarded data is not arriving and you find the gap, such as receiving not enabled or outputs.conf missing a server.

  • Command to file

    You match a CLI command to the configuration file and stanza it creates on the forwarder.

  • Default metadata

    You predict the host, source, sourcetype or index an event will receive when the input sets nothing explicitly.

Reasoning it through

A new universal forwarder shows no data on the indexer. The forwarder's outputs.conf lists idx1:9997, and splunkd.log shows connection refused. The candidate recognises that the indexer has not enabled receiving, so the fix is splunk enable listen 9997 or a splunktcp stanza on the indexer, not reinstalling the forwarder or changing its inputs.

Objectives 4

Official objectives from the Splunk outline, in outline order.

7.1 Describe the basic settings for an inputhost, source, sourcetype and index metadata.
What it means
Every input assigns four default fields to its events. host identifies the machine the data came from, source identifies the file path, port or script, sourcetype identifies the data format, and index decides where the events are stored. These can be set explicitly in the input stanza or left to defaults.
What to understand
If nothing is set, host defaults to the forwarder's hostname, source to the input path or port, sourcetype is assigned automatically or by rules, and index defaults to main. Setting sourcetype explicitly gives the most predictable parsing. Sending to an index that does not exist on the indexer causes events to be dropped with a warning.
How it shows up
You choose the metadata setting for a requirement or predict the default an event will get.
Common confusion
Assuming events go to a dedicated index automatically instead of to main.
7.2 List Splunk forwarder typesUniversal, heavy and the deprecated light forwarder.
What it means
The universal forwarder is a separate, lightweight package that collects and forwards data with minimal resource use and no Splunk Web. The heavy forwarder is a full Splunk Enterprise instance set to forward; it parses data and can filter, mask and route events before sending them. The light forwarder was an older reduced mode of Splunk Enterprise and is deprecated.
What to understand
Choose the universal forwarder for most endpoints. Choose a heavy forwarder when data must be parsed, filtered or routed before reaching indexers, or when an add-on needs a full instance, such as for some modular inputs. Universal forwarders send unparsed blocks, apart from structured data handled with indexed extractions.
How it shows up
A collection requirement is described and you choose the forwarder type.
Common confusion
Choosing a universal forwarder when the requirement is filtering or masking before indexing.
7.3 Configure the forwarderReceiving on the indexer and outputs.conf on the forwarder.
What it means
Forwarding needs two halves. On the indexer, enable receiving on a port, by convention 9997, through Splunk Web, splunk enable listen 9997 or a [splunktcp://9997] stanza in inputs.conf. On the forwarder, define outputs.conf with a [tcpout] default group and a [tcpout:<group>] stanza listing one or more indexer:port servers.
What to understand
Listing several indexers in one group enables automatic load balancing. The forwarder's own internal logs are forwarded by default, which helps troubleshooting from the indexer. Check splunkd.log on the forwarder for connection errors, and confirm the target index exists on every indexer.
How it shows up
Forwarded data is missing and you identify the incomplete half of the configuration.
Common confusion
Configuring outputs.conf on the forwarder but never enabling receiving on the indexer.
7.4 Add an input to UF using CLIsplunk add forward-server and splunk add monitor.
What it means
The universal forwarder has no Splunk Web, so inputs are added through the CLI or configuration files. splunk add forward-server idx1:9997 writes the receiving server to outputs.conf, and splunk add monitor /var/log/messages -index os -sourcetype syslog writes a monitor stanza to inputs.conf. splunk list forward-server and splunk list monitor confirm the results.
What to understand
CLI changes are written to local configuration files, so btool shows them. Most CLI commands prompt for admin credentials or accept -auth. For many forwarders, CLI changes do not scale; a deployment server should distribute inputs instead.
How it shows up
You choose the CLI command that adds an input or receiving server on a universal forwarder.
Common confusion
Using splunk add forward-server to add an input, or splunk add monitor to add an indexer.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Default metadata

    host, source, sourcetype and index on every event.

    Remember
    index defaults to main.
    Tested as
    Metadata questions.
    Trap
    Assuming a custom index is used automatically.

  • Universal forwarder

    Lightweight agent without Splunk Web.

    Remember
    Configured by CLI, files or deployment server.
    Tested as
    Forwarder type questions.
    Trap
    Expecting a web interface.

  • Heavy forwarder

    Full instance that parses before forwarding.

    Remember
    Needed for filtering, masking and routing at the edge.
    Tested as
    Placement questions.
    Trap
    Choosing it for simple collection.

  • Receiving port

    Indexer port for forwarded data, conventionally 9997.

    Remember
    Must be enabled explicitly.
    Tested as
    Connection troubleshooting.
    Trap
    Assuming it is open by default.

  • [splunktcp://9997]

    inputs.conf stanza for receiving forwarder traffic.

    Remember
    Different from a raw [tcp://] input.
    Tested as
    Receiving configuration items.
    Trap
    Using tcp:// for forwarders.

  • outputs.conf

    Forwarder file that defines target indexers.

    Remember
    [tcpout] and [tcpout:<group>] stanzas.
    Tested as
    Forwarder configuration.
    Trap
    Putting targets in inputs.conf.

  • splunk add forward-server

    CLI command that adds a receiving indexer.

    Remember
    Writes to outputs.conf.
    Tested as
    CLI questions.
    Trap
    Confusing it with add monitor.

  • splunk add monitor

    CLI command that adds a file or directory input.

    Remember
    Writes to inputs.conf.
    Tested as
    CLI questions.
    Trap
    Using it to add indexers.

  • Missing index

    Events sent to an index that does not exist.

    Remember
    They are dropped and a warning is logged.
    Tested as
    Missing data scenarios.
    Trap
    Expecting auto-creation.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Universal versus heavy forwarder

ConceptMeaningKey differenceCommon trap
Universal forwarder Lightweight separate package No parsing or Splunk Web Using it to mask data
Heavy forwarder Full Splunk Enterprise Parses, filters and routes Using it for every endpoint
Light forwarder Older reduced mode Deprecated Choosing it for new deployments

Forwarding configuration pieces

ConceptMeaningKey differenceCommon trap
Receiving on indexer splunktcp port enabled Listener side Forgetting it
outputs.conf on forwarder Target indexer list Sender side Editing inputs.conf instead
inputs.conf on forwarder What data to collect Collection side Confusing it with outputs

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Receiving is automatic

    What candidates pick
    Assume an indexer accepts forwarded data after install.
    Why it looks right
    Port 9997 is widely documented.
    Why it's wrong
    Receiving must be enabled explicitly in Splunk Web, the CLI or inputs.conf.

    Clue to watch for Forwarder logs show connection refused.

  2. tcp:// for forwarders

    What candidates pick
    Create a [tcp://9997] input for forwarder traffic.
    Why it looks right
    It is also a TCP port.
    Why it's wrong
    Forwarder traffic uses the Splunk-to-Splunk protocol, received by a [splunktcp://] stanza.

    Clue to watch for The sender is a Splunk forwarder.

  3. UF masks data

    What candidates pick
    Mask fields on a universal forwarder.
    Why it looks right
    It is closest to the source.
    Why it's wrong
    Masking needs the parsing pipeline on a heavy forwarder or indexer.

    Clue to watch for Data must be changed before it is indexed.

  4. Index auto-created

    What candidates pick
    Expect a new index to appear when a forwarder sends to it.
    Why it looks right
    Some products create targets on demand.
    Why it's wrong
    Splunk drops events for unknown indexes and logs a warning.

    Clue to watch for Data never appears in the expected index.

  5. add monitor adds a server

    What candidates pick
    Use splunk add monitor to point at an indexer.
    Why it looks right
    Both commands begin with splunk add.
    Why it's wrong
    add monitor creates inputs; add forward-server writes the receiving server to outputs.conf.

    Clue to watch for The task is choosing where to send data.

Answer framework

Use these steps for any Domain 7 question about getting a forwarder's data into Splunk.

  1. Decide whether the scenario needs a universal forwarder for simple collection or a heavy forwarder for parsing, filtering or routing.
  2. Check the indexer side first: receiving enabled on the expected port through a splunktcp stanza, and the target index created.
  3. Check the forwarder side: outputs.conf lists the correct indexer and port in a tcpout group, ideally several indexers for load balancing.
  4. Check the input: inputs.conf or splunk add monitor defines the path, plus explicit sourcetype and index metadata when needed.
  5. Confirm with splunk list commands, btool and splunkd.log, and move to a deployment server once many forwarders need the same change.

Practice question

A universal forwarder is configured with outputs.conf pointing to idx01:9997, and splunkd.log on the forwarder repeatedly shows connection refused errors. The indexer has the target index created. What should the admin do first?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Learn this topic by doing it once end to end. Install Splunk Enterprise as an indexer and a universal forwarder on another host or container. Enable receiving on the indexer, then on the forwarder run splunk add forward-server and splunk add monitor with an explicit index and sourcetype. Search for the data, then open outputs.conf and inputs.conf on the forwarder to see what the CLI wrote.

Next, break it deliberately: disable receiving, send to an index that does not exist and give a wrong port. Read splunkd.log on the forwarder and the internal logs on the indexer each time, so you recognise the symptoms the exam describes.

Finally, make a short table of the four metadata fields with their default values and a second table comparing universal and heavy forwarders. Review both before tackling Configuring Forwarders and the input topics, which extend these basics with load balancing, acknowledgement and more input types.

FAQ

How much of SPLK-1003 is Getting Data In?

Getting Data In is 5% of the exam, about three questions, covering input metadata, forwarder types, forwarder configuration and CLI inputs.

What is the default index for an input?

main. Set index explicitly in the input stanza or CLI command to send data elsewhere, and make sure that index exists on the indexers.

When should I use a heavy forwarder?

When data must be parsed, filtered, masked or routed before indexing, or when an add-on requires a full Splunk Enterprise instance.

How do I enable receiving on an indexer?

Use Settings, Forwarding and receiving in Splunk Web, run splunk enable listen 9997, or add a [splunktcp://9997] stanza to inputs.conf.

Which file does splunk add forward-server change?

outputs.conf on the forwarder, adding the indexer and port to a tcpout group.

Is the light forwarder still used?

No. It is deprecated; use the universal forwarder for lightweight collection or a heavy forwarder for parsing at the edge.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 7 knowledge

You have covered input metadata, forwarder types and the CLI for universal forwarders. Test whether you can find the missing piece when data does not arrive.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going