SPLK-1003 · Domain 9 of 17

SPLK-1003 Domain 9: Getting Data In – Staging

This staging topic places every input inside Splunk's data pipeline: the input, parsing and indexing phases and what happens in each, plus the full range of input types an admin can choose from before configuring them in later topics.

Exam weight
5%
Official objectives
2
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 9 min read Reviewed October 2026

Overview

Domain 9 has two official objectives: list the three phases of the Splunk indexing process and list Splunk input options. The three phases are input, where data is acquired in raw blocks and given source, host and sourcetype metadata; parsing, where data is broken into events, timestamps are assigned and index-time transforms run; and indexing, where events are written to disk in buckets. Search is a separate stage that follows.

The input options cover files and directories, network ports, scripted inputs, Windows inputs such as event logs, performance monitoring and WMI, the HTTP Event Collector and modular inputs from apps and add-ons. At 5%, expect around three questions, often asking which phase performs a given task or which component handles that phase.

How it's tested

Questions ask which phase performs a named task, which component runs that phase in a given architecture, or which input type suits a described source. They are short and definitional, but distractors swap parsing and input tasks deliberately, so read each task name carefully.

  • Name the phase

    A task such as line breaking, compression or metadata assignment is given and you choose input, parsing or indexing.

  • Where does it run

    You decide whether a universal forwarder, heavy forwarder or indexer performs a given phase.

  • Pick the input type

    A data source is described and you choose among file, network, scripted, Windows, HEC or modular inputs.

Reasoning it through

Timestamps from a forwarded file are wrong. Timestamp extraction belongs to the parsing phase, and a universal forwarder does not parse, so the fix belongs in props.conf on the indexers or on an intermediate heavy forwarder. A candidate who places TIME_FORMAT only on the universal forwarder makes no difference, because that instance only performs the input phase.

Objectives 2

Official objectives from the Splunk outline, in outline order.

9.1 List the three phases of the Splunk Indexing processInput, parsing and indexing.
What it means
Splunk processes data through three phases before it can be searched. In the input phase, data is read in raw blocks and annotated with source, host and sourcetype, and character encoding is applied. In the parsing phase, data is broken into events, timestamps are identified, and index-time transforms such as masking and routing run. In the indexing phase, events are segmented, compressed and written to buckets with their index files.
What to understand
Map each phase to components. Universal forwarders perform input. Heavy forwarders perform input and parsing. Indexers perform parsing and indexing for data that arrives unparsed, and indexing only for data already parsed by a heavy forwarder. Search-time processing, such as field extraction, is separate from these phases.
How it shows up
A task is named and you identify its phase or the component where it should be configured.
Common confusion
Placing line breaking or masking in the input phase on a universal forwarder.
9.2 List Splunk input optionsFiles, network, scripted, Windows, HEC and modular inputs.
What it means
Splunk can collect data by monitoring files and directories, listening on TCP or UDP ports, running scripts on a schedule, reading Windows sources such as event logs, performance counters, registry and Active Directory, querying remote Windows hosts through WMI, receiving events over HTTP with the HTTP Event Collector, and running modular inputs provided by apps and add-ons.
What to understand
Choose the option that matches the source: files for logs on disk, network ports for devices that send syslog, scripts for command output or APIs, HEC for applications that can post events, and add-ons for vendor products. Inputs can be added in Splunk Web, the CLI or inputs.conf, and the Add Data wizard guides basic choices.
How it shows up
A data source is described and you choose the input option that fits.
Common confusion
Choosing a network input for a log file already written to local disk.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Input phase

    Reads raw data blocks and assigns source, host and sourcetype.

    Remember
    Performed by universal forwarders.
    Tested as
    Phase identification.
    Trap
    Expecting line breaking here.

  • Parsing phase

    Line breaking, timestamps and index-time transforms.

    Remember
    Runs on heavy forwarders or indexers.
    Tested as
    Placement questions.
    Trap
    Configuring it on a UF.

  • Indexing phase

    Segmentation, compression and writing to buckets.

    Remember
    Always on the indexer.
    Tested as
    Phase identification.
    Trap
    Thinking forwarders index data.

  • Search time

    Field extraction and lookups when searching.

    Remember
    Separate from the three indexing phases.
    Tested as
    Index-time versus search-time items.
    Trap
    Calling it a fourth indexing phase.

  • Monitor input

    Watches files and directories for new data.

    Remember
    Uses the fishbucket to track progress.
    Tested as
    Input choice questions.
    Trap
    Using a network input for local files.

  • Network input

    Listens on TCP or UDP ports.

    Remember
    Common for syslog sources.
    Tested as
    Input choice questions.
    Trap
    Using it for forwarder traffic.

  • Scripted input

    Runs a script and indexes its output.

    Remember
    Scheduled by interval or cron.
    Tested as
    Input choice questions.
    Trap
    Expecting it to read files directly.

  • HTTP Event Collector

    Token-based input for events sent over HTTP or HTTPS.

    Remember
    Agentless for applications.
    Tested as
    Input choice questions.
    Trap
    Requiring a forwarder.

  • Modular input

    Custom input type delivered in an app or add-on.

    Remember
    Configured like built-in inputs.
    Tested as
    Add-on scenarios.
    Trap
    Thinking it needs code from the admin.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Indexing phases

ConceptMeaningKey differenceCommon trap
Input Acquire data and add metadata UF, HF or indexer Adding line breaking here
Parsing Events, timestamps, transforms HF or indexer only Configuring it on a UF
Indexing Write buckets and index files Indexer only Thinking forwarders index

Input options

ConceptMeaningKey differenceCommon trap
Files and directories Logs on disk Monitor stanza Using network inputs instead
Network ports Syslog and device streams TCP or UDP stanza Mixing with splunktcp
Scripted Command or API output Interval-based Confusing with modular
HEC Applications posting events Token authentication Assuming a forwarder is needed

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. UF parses timestamps

    What candidates pick
    Set TIME_FORMAT only on the universal forwarder.
    Why it looks right
    The forwarder reads the data first.
    Why it's wrong
    Timestamp extraction is parsing, which the universal forwarder does not perform.

    Clue to watch for The source is a universal forwarder.

  2. Masking at input

    What candidates pick
    Call masking an input-phase task.
    Why it looks right
    It happens before indexing.
    Why it's wrong
    Masking with transforms or SEDCMD runs in the parsing phase.

    Clue to watch for The task changes event content.

  3. Search time is a phase

    What candidates pick
    Name search as the third indexing phase.
    Why it looks right
    Search follows indexing.
    Why it's wrong
    The three indexing phases are input, parsing and indexing; search time is separate.

    Clue to watch for The question asks for indexing phases.

  4. Network for files

    What candidates pick
    Collect local log files with a TCP input.
    Why it looks right
    Network inputs sound universal.
    Why it's wrong
    Files on disk are best collected with a monitor input that tracks progress.

    Clue to watch for The logs already exist on disk.

  5. Parse twice

    What candidates pick
    Expect the indexer to re-parse data from a heavy forwarder.
    Why it looks right
    Indexers normally parse.
    Why it's wrong
    Data parsed by a heavy forwarder arrives cooked and the indexer only indexes it.

    Clue to watch for A heavy forwarder sits in the path.

Answer framework

Apply this sequence to place any task or source in Splunk's pipeline.

  1. Decide whether the task acquires data, changes or structures events, writes data to disk, or happens only when users search.
  2. Map acquisition and metadata to input, events, timestamps and transforms to parsing, and bucket writing to indexing.
  3. Find the first instance in the data path that performs that phase, remembering that universal forwarders stop after the input phase.
  4. If a heavy forwarder is present, place parsing settings there, since indexers will not parse cooked data again.
  5. For a new source, choose the input option that matches how the data is produced: files, network ports, scripts, Windows sources, HEC or add-ons.

Practice question

Data flows from universal forwarders through a heavy forwarder to the indexers. An admin needs to change line-breaking rules for one sourcetype. Where must the props.conf change be made for it to take effect?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This topic rewards a single clear diagram. Draw three boxes for input, parsing and indexing, list the tasks under each, and then draw three data paths underneath: universal forwarder to indexer, heavy forwarder to indexer, and a single instance. Shade the boxes each component performs. Keep this diagram in front of you while you study the input, parsing and raw data topics.

Next, list every input option with one example source for each. Open the Add Data page in Splunk Web to see how Splunk groups these options, and look at a few add-ons on Splunkbase to see modular inputs in practice.

Finally, quiz yourself with tasks: line breaking, CHARSET, SEDCMD, sourcetype override, compression, field extraction. Name the phase and the instance where each belongs. Ten minutes of this drill repeated over several days makes the related exam questions straightforward, and it also prepares you for the props.conf placement questions that appear in three later topics.

FAQ

How much of SPLK-1003 is Getting Data In – Staging?

Getting Data In – Staging is 5% of the exam, about three questions, covering the indexing phases and input options.

What are the three phases of indexing?

Input, parsing and indexing. Search-time processing happens later and is not one of the three.

Does the universal forwarder parse data?

No. It performs the input phase only, except for structured files handled with indexed extractions.

Where does parsing happen if there is a heavy forwarder?

On the heavy forwarder. The indexers receive already-parsed data and only index it.

Which input should I use for syslog devices?

A network input on TCP or UDP, or a syslog server writing files that a forwarder monitors, which is often more resilient.

What is a modular input?

A custom input type supplied by an app or add-on, configured like built-in inputs once installed.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 9 knowledge

You have placed each task in the input, parsing or indexing phase and reviewed input options. Test whether you can put settings on the right instance.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going