SPLK-1003 · Domain 13 of 17

SPLK-1003 Domain 13: Network and Scripted Inputs

Network and Scripted Inputs covers collecting data that is not sitting in files: listening for TCP and UDP streams such as syslog, tuning those inputs with optional settings, and running scripts on a schedule to index their output.

Exam weight
5%
Official objectives
3
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 9 min read Reviewed October 2026

Overview

Domain 13 has three official objectives: create network (TCP and UDP) inputs, describe optional settings for network inputs and create a basic scripted input. Network inputs are inputs.conf stanzas such as [tcp://5140] or [udp://514] that make Splunk listen on a port, commonly for syslog from network devices. Optional settings decide how the host field is set, which senders are accepted, how much data is queued, and how syslog headers are handled. Scripted inputs, written as [script://<path>], run a program at an interval and index whatever it writes to standard output.

At 5%, expect around three questions. Typical items ask how host is assigned for a network input, why a UDP feed loses data or how a script must be placed and scheduled.

How it's tested

Questions present a device or data source that sends over the network or needs a script, then ask how to configure the stanza, how host will be assigned, or why data is missing. Expect inputs.conf snippets and choices that differ by one attribute, so read each stanza line carefully before answering.

  • Set the host

    You decide what host value network events will carry based on connection_host and related settings.

  • Make UDP reliable

    Dropped syslog data is described and you choose queue settings or a syslog server plus monitor input design.

  • Schedule a script

    You choose where a script must live and how the interval controls when it runs.

Reasoning it through

Firewall events arrive over UDP 514, but every event shows the indexer's name as host. The candidate checks the stanza and finds connection_host = none, which uses the receiving server's host value. Setting connection_host = ip, the UDP default, or dns makes the firewall's own address or name the host. Changing the sourcetype would not affect this field at all.

Objectives 3

Official objectives from the Splunk outline, in outline order.

13.1 Create network (TCP and UDP) inputsRaw TCP and UDP listener stanzas.
What it means
A network input makes a Splunk instance listen on a port. [tcp://<port>] accepts raw TCP connections, and [udp://<port>] accepts UDP datagrams, typically syslog. You can restrict a stanza to one sender with [tcp://<remote server>:<port>]. Inputs can be created in Splunk Web under Data inputs, with the CLI or in inputs.conf, with sourcetype and index set explicitly.
What to understand
Raw network inputs are different from [splunktcp://] inputs, which receive data from Splunk forwarders. Ports below 1024 require Splunk to run with elevated privileges. UDP has no delivery guarantee, so data can be lost during restarts; many sites send syslog to a syslog server or Splunk Connect for Syslog and collect it from there.
How it shows up
A device sends data over the network and you choose the correct stanza type and port.
Common confusion
Using a splunktcp stanza for a network device, or a tcp stanza for forwarders.
13.2 Describe optional settings for network inputsconnection_host, acceptFrom, queues and syslog handling.
What it means
Optional settings shape network inputs. connection_host sets host to the sender's ip, its dns name or none, which keeps the receiving server's value. acceptFrom limits which addresses may connect. queueSize and persistentQueueSize control in-memory and on-disk buffering when the pipeline is busy. For UDP syslog, no_priority_stripping and no_appending_timestamp control header handling.
What to understand
The default connection_host is dns for TCP and ip for UDP. A persistent queue writes overflow to disk, which helps absorb bursts for network inputs that cannot pause the sender. acceptFrom accepts lists of addresses, networks and exclusions to reduce exposure.
How it shows up
A network input behaves unexpectedly and you choose the optional setting that changes it.
Common confusion
Expecting connection_host to change the source or sourcetype instead of the host field.
13.3 Create a basic scripted inputRunning scripts on an interval and indexing their output.
What it means
A scripted input runs a program and indexes what it writes to standard output. It is defined as [script://<path>] in inputs.conf, with interval set in seconds or as a cron schedule, plus sourcetype and index. Scripts must be placed in an app's bin directory, $SPLUNK_HOME/bin/scripts or etc/system/bin.
What to understand
Use scripted inputs to collect command output, query APIs or read data that has no file or network feed. The default interval is 60 seconds. Splunk runs the script with its own environment and user, so test it as that user. Modular inputs offer a more structured alternative when an add-on provides one.
How it shows up
You choose the stanza, script location or interval for a scripted input requirement.
Common confusion
Placing the script in an arbitrary directory outside the permitted bin locations.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • [tcp://<port>]

    Raw TCP listener stanza.

    Remember
    Not for forwarder traffic.
    Tested as
    Stanza choice questions.
    Trap
    Using it for forwarders.

  • [udp://<port>]

    UDP listener, often for syslog.

    Remember
    No delivery guarantee.
    Tested as
    Syslog questions.
    Trap
    Assuming reliable delivery.

  • connection_host

    Sets host from the sender: ip, dns or none.

    Remember
    Default dns for TCP, ip for UDP.
    Tested as
    Host value questions.
    Trap
    Thinking it sets source.

  • acceptFrom

    Restricts which senders may connect.

    Remember
    Accepts addresses and networks.
    Tested as
    Security questions.
    Trap
    Using a firewall setting instead.

  • persistentQueueSize

    On-disk buffer for network and scripted inputs.

    Remember
    Absorbs bursts when indexing slows.
    Tested as
    Data loss questions.
    Trap
    Confusing it with queueSize.

  • Syslog server pattern

    Send syslog to a syslog server and monitor its files.

    Remember
    More resilient than direct UDP.
    Tested as
    Design questions.
    Trap
    Sending all syslog straight to an indexer.

  • Privileged ports

    Ports below 1024 need elevated privileges.

    Remember
    Port 514 is privileged.
    Tested as
    Listener failure scenarios.
    Trap
    Blaming the device.

  • [script://<path>]

    Scripted input stanza.

    Remember
    Indexes standard output.
    Tested as
    Scripted input questions.
    Trap
    Expecting it to read files.

  • interval

    Seconds or cron schedule for scripts.

    Remember
    Default 60 seconds.
    Tested as
    Scheduling questions.
    Trap
    Assuming scripts run once.

  • Script locations

    App bin, $SPLUNK_HOME/bin/scripts or etc/system/bin.

    Remember
    Other paths are rejected.
    Tested as
    Placement questions.
    Trap
    Using /tmp or home directories.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Network input types

ConceptMeaningKey differenceCommon trap
tcp:// Raw TCP stream Devices and applications Using it for forwarders
udp:// UDP datagrams Syslog, no delivery guarantee Expecting reliability
splunktcp:// Forwarder protocol Splunk-to-Splunk only Using it for devices

connection_host values

ConceptMeaningKey differenceCommon trap
ip Sender IP address UDP default Expecting a hostname
dns Reverse DNS name TCP default Ignoring DNS lookup cost
none Receiving server's host value Sender not identified Expecting device names

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. splunktcp for syslog

    What candidates pick
    Create a splunktcp input for firewall syslog.
    Why it looks right
    It is a TCP input too.
    Why it's wrong
    splunktcp expects the forwarder protocol; devices need tcp or udp stanzas.

    Clue to watch for The sender is a network device.

  2. connection_host sets source

    What candidates pick
    Use connection_host to change the source field.
    Why it looks right
    It relates to the sender.
    Why it's wrong
    connection_host only controls the host field.

    Clue to watch for The problem is the host value.

  3. UDP is reliable

    What candidates pick
    Rely on direct UDP syslog with no buffering.
    Why it looks right
    It works most of the time.
    Why it's wrong
    UDP has no acknowledgements, so restarts and bursts can drop data.

    Clue to watch for Data gaps appear during maintenance.

  4. Any script path

    What candidates pick
    Reference a script in a user home directory.
    Why it looks right
    The path is valid on the host.
    Why it's wrong
    Splunk only runs scripts from approved bin directories.

    Clue to watch for The script never runs.

  5. Script runs once

    What candidates pick
    Expect a scripted input to run only at startup.
    Why it looks right
    Scripts are often one-off tasks.
    Why it's wrong
    The interval setting reruns it, every 60 seconds by default.

    Clue to watch for The question mentions repeated data.

Answer framework

Use these steps when a question involves a network or scripted input in Splunk.

  1. Decide whether the data arrives over the network from a device, comes from a Splunk forwarder, or must be produced by running a script.
  2. For devices choose a tcp or udp stanza with an explicit sourcetype and index; reserve splunktcp stanzas for traffic sent by Splunk forwarders.
  3. Set connection_host to ip, dns or none to control the host field, and add acceptFrom to limit which senders may connect.
  4. For unreliable or bursty feeds, add persistent queues or move to a syslog server writing files that a forwarder monitors.
  5. For scripts, place them in an approved bin directory, set interval in seconds or cron, and test them as the Splunk user.

Practice question

A network team sends syslog from 200 switches to a Splunk indexer on UDP 514. Events arrive, but some are lost whenever the indexer restarts, and every event shows the same host value. Which change addresses both issues most effectively?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Split your time between network inputs and scripted inputs, giving network inputs a little more because they carry two objectives. In a lab, create a UDP input on a high port such as 5514 and send test messages with logger or netcat. Search the results and note the host value, then change connection_host to dns and none and compare. Add acceptFrom with a single address and confirm other senders are refused.

Next, create a TCP input and send data the same way, then try sending forwarder traffic to it to see why splunktcp is different. Read the network inputs section of the inputs.conf specification so the optional attributes are familiar by name.

For scripted inputs, write a short shell or PowerShell script that prints the date and a few values, place it in an app's bin directory, and schedule it every 60 seconds. Then try placing it elsewhere and watch it fail. Finish with practice questions that focus on host values, UDP reliability and script placement, the three areas that produce most wrong answers here.

FAQ

How much of SPLK-1003 is Network and Scripted Inputs?

Network and Scripted Inputs is 5% of the exam, about three questions, covering TCP and UDP inputs, their options and scripted inputs.

What is the default connection_host?

dns for TCP inputs and ip for UDP inputs. Set none to use the receiving server's host value instead.

Why is syslog over UDP often sent to a syslog server first?

UDP has no delivery guarantee, so a dedicated syslog server writing files that Splunk monitors reduces loss during restarts.

Can I receive forwarder data on a tcp:// input?

No. Forwarder traffic needs a splunktcp:// input. tcp:// is for raw data from devices and applications.

Where must a scripted input's script be stored?

In an app's bin directory, $SPLUNK_HOME/bin/scripts or $SPLUNK_HOME/etc/system/bin.

How often does a scripted input run?

According to its interval, in seconds or as a cron expression. The default is every 60 seconds.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 13 knowledge

You have covered TCP and UDP inputs, their optional settings and scripted inputs. Test whether you can set host values correctly and avoid data loss.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going