Overview
Domain 12 has three official objectives: create file and directory monitor inputs, use optional settings for monitor inputs and deploy a remote monitor input. A monitor stanza in inputs.conf, such as [monitor:///var/log/secure], tells Splunk to read a file or every file under a directory, continue reading as data is appended and track progress in the fishbucket. Optional settings control which files are read, how host and sourcetype are set and how rotated or similar files are handled.
At 5%, expect around three questions. They often show a monitor stanza and ask what it collects, or describe a problem such as files being skipped or indexed twice and ask which setting fixes it. Remote deployment links this topic to forwarder management.
How it's tested
Expect stanza interpretation and troubleshooting. You may see a monitor stanza with whitelist or blacklist regexes and decide which files match, or read about files being skipped, duplicated or mislabelled and choose the setting that resolves it without side effects.
-
What does it collect
A stanza with a path and filters is shown and you decide which files are monitored.
-
Fix the file problem
Files are skipped, re-indexed or tagged with the wrong host and you choose the optional setting that fixes it.
-
Deploy it remotely
You choose how to deliver a monitor input to many forwarders, usually through a deployment app.
New log files on an application server are not indexed, though older ones were. Each file starts with an identical 300-byte header. Splunk compares a CRC of the first 256 bytes, so it treats new files as already read. The candidate adds crcSalt = <SOURCE> to include the path in the check, or raises initCrcLength, instead of resetting the fishbucket.
Objectives 3
Official objectives from the Splunk outline, in outline order.
12.1 Create file and directory monitor inputsMonitor stanzas for files and directories.
- What it means
- A monitor input watches a file or directory and indexes new data as it is written. In inputs.conf it is written as [monitor://<path>], with settings such as index, sourcetype and host. It can be created in Splunk Web, with splunk add monitor or by editing inputs.conf. Monitoring a directory includes its subdirectories by default.
- What to understand
- Splunk reads each file from where it left off, using the fishbucket, so restarts do not duplicate data. Rotated files are recognised by their CRC and not re-indexed. Compressed archives are decompressed and read. Use batch inputs with move_policy = sinkhole for one-time loads that delete files after reading.
- How it shows up
- A stanza or requirement is described and you decide what will be monitored and with which metadata.
- Common confusion
- Assuming directory monitoring ignores subdirectories unless recursion is enabled.
12.2 Use optional settings for monitor inputswhitelist, blacklist, crcSalt, ignoreOlderThan and host settings.
- What it means
- Optional settings refine monitoring. whitelist and blacklist take regular expressions matched against the full path to include or exclude files. ignoreOlderThan skips files whose modification time is older than a given age. crcSalt = <SOURCE> adds the path to the CRC so files with identical headers are treated as different, and initCrcLength changes how many bytes are checked. host_segment and host_regex set host from the path. recursive = false stops descending into subdirectories.
- What to understand
- Blacklist takes precedence over whitelist. Once ignoreOlderThan skips a file, Splunk stops checking it, so later writes to that file are not picked up until the input is reset or Splunk restarts. crcSalt = <SOURCE> can cause rotated files with new names to be re-indexed, so use it carefully. followTail starts reading at the end of a file on first discovery.
- How it shows up
- A collection problem is described and you choose the optional setting that resolves it.
- Common confusion
- Using crcSalt = <SOURCE> on logs that rotate by renaming, which re-indexes rotated files.
12.3 Deploy a remote monitor inputDelivering monitor stanzas to forwarders.
- What it means
- A remote monitor input is a monitor stanza that runs on a forwarder rather than on the instance where it was designed. It is usually delivered by placing inputs.conf in a deployment app, mapping that app to a server class on the deployment server and letting clients download it. Splunk Web on the deployment server can also create remote inputs for a server class.
- What to understand
- The target index must exist on the indexers, and the app should normally restart the client so the new input starts. Keep data-source apps separate from outputs apps so the same input can be combined with different destinations. Avoid editing inputs.conf on individual forwarders when a deployment server is in use.
- How it shows up
- Many forwarders need the same input and you choose the deployment approach.
- Common confusion
- Editing inputs.conf on each forwarder by hand when a deployment server already manages them.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
[monitor://<path>]
inputs.conf stanza that watches a file or directory.
- Remember
- Three slashes for an absolute Linux path.
- Tested as
- Stanza questions.
- Trap
- Forgetting the extra slash.
-
Recursive directories
Directory monitors include subdirectories by default.
- Remember
- Set recursive = false to stop it.
- Tested as
- Scope questions.
- Trap
- Assuming recursion is off.
-
whitelist and blacklist
Regex filters on full file paths.
- Remember
- Blacklist wins over whitelist.
- Tested as
- Filter questions.
- Trap
- Writing globs instead of regex.
-
crcSalt = <SOURCE>
Adds the file path to the CRC check.
- Remember
- Helps files with identical headers.
- Tested as
- Skipped file scenarios.
- Trap
- Using it with renamed rotation.
-
initCrcLength
Bytes used for the initial CRC, default 256.
- Remember
- Increase for long common headers.
- Tested as
- Skipped file scenarios.
- Trap
- Confusing it with TRUNCATE.
-
ignoreOlderThan
Skips files older than a set age.
- Remember
- Ignored files are not rechecked, even if modified later.
- Tested as
- Old file questions.
- Trap
- Expecting it to delete files.
-
host_segment
Sets host from a path segment.
- Remember
- host_regex uses a pattern instead.
- Tested as
- Host assignment questions.
- Trap
- Leaving host as the forwarder name.
-
followTail
Starts reading at the end of newly found files.
- Remember
- Skips existing content.
- Tested as
- Backlog questions.
- Trap
- Using it when history is needed.
-
Batch with sinkhole
One-time ingestion that deletes files after reading.
- Remember
- Not for live logs.
- Tested as
- One-off load questions.
- Trap
- Using it on files still being written.
-
Remote monitor input
Monitor stanza delivered to forwarders.
- Remember
- Usually via a deployment app.
- Tested as
- Deployment questions.
- Trap
- Editing each forwarder by hand.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Monitor optional settings
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| whitelist | Include matching paths | Regex on full path | Using shell globs |
| blacklist | Exclude matching paths | Wins over whitelist | Assuming whitelist wins |
| crcSalt | Add path to CRC | Fixes identical headers | Re-indexing renamed rotations |
| ignoreOlderThan | Skip old files | Based on modification time | Expecting deletion |
File input types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| monitor | Continuous tailing | Tracks progress in fishbucket | Using it for one-off loads that should be removed |
| batch with sinkhole | One-time load | Deletes files after indexing | Using it on live logs |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Reset the fishbucket
- What candidates pick
- Clear the whole fishbucket to pick up skipped files.
- Why it looks right
- It forces Splunk to re-read files.
- Why it's wrong
- That re-indexes every monitored file; the real fix is crcSalt or initCrcLength.
Clue to watch for New files share a common header.
-
Whitelist wins
- What candidates pick
- Expect a file matching both filters to be indexed.
- Why it looks right
- It was explicitly included.
- Why it's wrong
- Blacklist takes precedence over whitelist for monitor inputs.
Clue to watch for The path matches both regexes.
-
Globs in whitelist
- What candidates pick
- Write *.log as the whitelist value.
- Why it looks right
- Shell patterns look natural.
- Why it's wrong
- whitelist and blacklist are regular expressions, so \.log$ is the correct style.
Clue to watch for The stanza uses a filter attribute.
-
Recursion off
- What candidates pick
- Add recursive = true to include subdirectories.
- Why it looks right
- Many tools are non-recursive by default.
- Why it's wrong
- Directory monitors are recursive by default; recursive = false turns it off.
Clue to watch for Subdirectory files are already indexed.
-
Sinkhole for live logs
- What candidates pick
- Use a batch sinkhole input for an active application log.
- Why it looks right
- It also reads files.
- Why it's wrong
- Sinkhole deletes files after reading, which is wrong for logs still being written.
Clue to watch for The log is continuously appended.
Answer framework
Use these steps when a question involves a monitor input.
- Read the stanza path and decide whether it is a single file or a directory, remembering directories are recursive by default.
- Apply whitelist and blacklist regexes to the full path, with blacklist winning, to find exactly which files are collected.
- For skipped or duplicated files, consider CRC behaviour and choose crcSalt or initCrcLength rather than clearing the fishbucket.
- Check metadata: index must exist, sourcetype should be explicit, and host_segment or host_regex can derive host from the path.
- For many forwarders, place the stanza in a deployment app mapped to a server class and let the clients restart so the new input starts.
Practice question
Want more like this? The SPLK-1003 practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Practise this topic with real files. On a test forwarder, create a directory with several log files, some in subdirectories and some compressed, and add a directory monitor. Then add whitelist and blacklist regexes and use splunk list monitor and the internal logs to see which files are included.
Next, recreate the identical header problem: generate new files that start with the same long banner and watch them get skipped. Fix it with crcSalt and then with initCrcLength, noting the trade-offs. Try host_segment on a path such as /logs/<hostname>/app.log to see host assignment change.
Finally, package your monitor stanza as a deployment app and push it to a second forwarder through a server class, which ties this topic to Forwarder Management. Make a short table of optional settings with the problem each solves and review it before practice questions on monitor inputs. Pay particular attention to the CRC behaviour, since it explains most skipped-file and duplicate-data scenarios.
FAQ
How much of SPLK-1003 is Monitor Inputs?
Monitor Inputs is 5% of the exam, about three questions, covering monitor stanzas, optional settings and remote monitor inputs.
Are subdirectories monitored by default?
Yes. A directory monitor is recursive unless you set recursive = false.
Which wins, whitelist or blacklist?
Blacklist. A file that matches both filters is excluded.
Why are new files with the same header skipped?
Splunk identifies files by a CRC of their first bytes. Use crcSalt = <SOURCE> or a larger initCrcLength so they are treated as different.
What does ignoreOlderThan do?
It skips files whose modification time is older than the set age. Splunk then stops checking those files, so new writes to them are not indexed until the input is reset or Splunk restarts.
How do I deploy the same monitor input to many forwarders?
Put the stanza in a deployment app on the deployment server, map it to a server class and let clients download and restart.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 12 knowledge
You have covered monitor stanzas, optional settings and remote deployment. Test whether you can fix skipped, duplicated or mislabelled file inputs.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the SPLK-1003 AI tutor Get any concept explained your way