SPLK-1003 · Domain 1 of 17

SPLK-1003 Domain 1: Splunk Admin Basics

The opening blueprint topic checks that you can name every Splunk Enterprise component, say what work it performs, and place it correctly in a single-instance or distributed deployment before any configuration questions begin.

Exam weight
5%
Official objectives
1
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 10 min read Reviewed October 2026

Overview

Domain 1 has a single official objective: identify Splunk components. That covers the processing components that handle data (forwarders, indexers and search heads) and the management components that coordinate them, such as the deployment server, license manager, cluster manager, deployer and Monitoring Console. You should also know the default network ports each component uses and how one Splunk Enterprise installation can play several roles at once.

The topic is small at 5%, roughly three questions, but it sets up the whole exam. Every later topic assumes you can tell which instance performs parsing, which stores buckets, which runs searches and which pushes apps to clients. Note that Cisco now owns Splunk, and from 20 October 2026 SPLK-1003 registration runs through Cisco's certification system; the blueprint itself is unchanged.

How it's tested

Expect short identification items. A scenario describes a task, such as storing data, running searches or distributing configuration, and you pick the component that performs it. Some items list several roles and ask which can share one instance, and others test default ports or the current manager and peer naming used in Splunk Enterprise 9 and 10.

  • Which component does this

    A job such as indexing, search coordination or app distribution is described and you choose the Splunk component responsible for it.

  • Processing versus management

    The question separates components that touch data from those that only coordinate other instances, like the license manager or deployer.

  • Default port recall

    You match a function to its default port: 8000 for Splunk Web, 8089 for management, 9997 for receiving and 8088 for HEC.

Reasoning it through

An admin needs one place to push identical inputs.conf files to 400 universal forwarders. Indexers store data and search heads run searches, so neither fits. The cluster manager only manages indexer peers, and the deployer only serves search head cluster members. The deployment server is the component built to send apps to forwarders, so it is the correct choice.

Objectives 1

Official objectives from the Splunk outline, in outline order.

1.1 Identify Splunk componentsProcessing and management components of Splunk Enterprise and what each does.
What it means
Splunk Enterprise is one software package that can be configured into different roles. Processing components are forwarders, which collect and send data; indexers, which parse, store and search data; and search heads, which accept user searches and merge results. Management components include the deployment server, license manager, cluster manager for indexer clusters, deployer for search head clusters, and the Monitoring Console.
What to understand
Know the work each role performs and where it sits in the data pipeline. Universal forwarders are a separate lightweight package; heavy forwarders are full Splunk Enterprise installs that parse. Indexers write buckets and answer search requests from search heads. Small sites can combine roles on one host, while larger sites separate them. Recognise the newer names: license manager and cluster manager replace license master and cluster master.
How it shows up
A described task is matched to the component that performs it, often contrasting deployment server, deployer and cluster manager.
Common confusion
Assuming the universal forwarder parses events like a heavy forwarder, or that the deployer pushes apps to forwarders.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Indexer

    Parses incoming data, writes it into index buckets and answers search requests.

    Remember
    Also called a search peer in distributed search.
    Tested as
    Core role identification.
    Trap
    Thinking indexers serve the web interface for users.

  • Search head

    Accepts searches from users, distributes them to indexers and merges results.

    Remember
    Holds knowledge objects such as saved searches and dashboards.
    Tested as
    Distributed search and role questions.
    Trap
    Believing search heads store indexed data.

  • Universal forwarder

    A lightweight separate package that collects and forwards data.

    Remember
    It does not parse events, except for structured data with indexed extractions.
    Tested as
    Forwarder type questions.
    Trap
    Treating it as a parsing tier.

  • Heavy forwarder

    A full Splunk Enterprise instance configured to forward.

    Remember
    It parses, so it can filter, mask and route data.
    Tested as
    Where to place transforms.
    Trap
    Picking it when a lightweight agent is needed.

  • Deployment server

    Distributes deployment apps to deployment clients such as forwarders.

    Remember
    Clients poll it; it does not push unsolicited.
    Tested as
    Forwarder management questions.
    Trap
    Using it for indexer cluster peers.

  • License manager

    Hosts license files and tracks daily ingest for its license peers.

    Remember
    Formerly called the license master.
    Tested as
    License questions.
    Trap
    Confusing it with the cluster manager.

  • Cluster manager

    Coordinates an indexer cluster's replication and peer configuration bundles.

    Remember
    Formerly the cluster master.
    Tested as
    Scaling and component questions.
    Trap
    Assuming it manages forwarders.

  • Deployer

    Distributes apps and configuration to search head cluster members.

    Remember
    Not a cluster member itself.
    Tested as
    Search head scaling questions.
    Trap
    Mixing it up with the deployment server.

  • Monitoring Console

    Built-in dashboards for the health and performance of a deployment.

    Remember
    Can run standalone or in distributed mode.
    Tested as
    Monitoring and troubleshooting items.
    Trap
    Calling it a separate product to install.

  • Default ports

    8000 Splunk Web, 8089 splunkd management, 9997 conventional receiving, 8088 HEC.

    Remember
    9997 is a convention you configure; it is not open by default.
    Tested as
    Port recall items.
    Trap
    Assuming receiving is enabled out of the box.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Processing components

ConceptMeaningKey differenceCommon trap
Universal forwarder Collects and sends raw data No parsing, small footprint Expecting it to mask or route events
Heavy forwarder Full instance that forwards Parses before sending Using it where a UF is enough
Indexer Parses and stores in buckets Answers peer searches Thinking it serves user dashboards
Search head Runs and merges searches Stores knowledge objects, not data Thinking it holds indexes

Management components

ConceptMeaningKey differenceCommon trap
Deployment server Sends apps to clients Targets forwarders and other clients Using it for cluster peers
Deployer Sends apps to SHC members Search head clusters only Confusing it with deployment server
Cluster manager Coordinates indexer cluster Replication and peer bundles Calling it the license manager
License manager Tracks license usage Peers report ingest to it Assuming every indexer holds its own license

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Deployer for forwarders

    What candidates pick
    Pick the deployer to send inputs to forwarders.
    Why it looks right
    The name suggests deploying anything.
    Why it's wrong
    The deployer only distributes configuration to search head cluster members; forwarders use the deployment server.

    Clue to watch for The targets are universal forwarders.

  2. UF parses

    What candidates pick
    Choose a universal forwarder to mask credit card numbers.
    Why it looks right
    It is the first component to touch the data.
    Why it's wrong
    Masking happens in the parsing pipeline, which runs on indexers or heavy forwarders.

    Clue to watch for The task changes event content before indexing.

  3. Search head stores data

    What candidates pick
    Say the search head holds the indexed events.
    Why it looks right
    Users see data on the search head.
    Why it's wrong
    Search heads send requests to indexers, which store buckets and return results.

    Clue to watch for The question asks where events are written to disk.

  4. Cluster manager licenses

    What candidates pick
    Pick the cluster manager to track daily ingest.
    Why it looks right
    Both are central manager roles.
    Why it's wrong
    License usage is reported to the license manager, a separate function even if co-located.

    Clue to watch for The scenario mentions daily volume or license warnings.

  5. 9997 by default

    What candidates pick
    Assume an indexer receives forwarded data right after install.
    Why it looks right
    9997 is the familiar receiving port.
    Why it's wrong
    Receiving must be enabled through Splunk Web, the CLI or a splunktcp stanza in inputs.conf.

    Clue to watch for Forwarders cannot connect to a fresh indexer.

Answer framework

Use these steps when a Domain 1 item asks which Splunk component fits a described job.

  1. Decide whether the job touches data directly, meaning collection, parsing, storage or search, or only coordinates other Splunk instances.
  2. For data jobs, follow the pipeline: forwarders collect, indexers or heavy forwarders parse, indexers store, and search heads run user searches.
  3. For coordination jobs, ask what is being managed: forwarders point to the deployment server, SHC members to the deployer and indexer peers to the cluster manager.
  4. If licensing or daily ingest is mentioned, choose the license manager and remember peers report usage to it.
  5. Check the answer wording for current names and default ports, rejecting options that rely on retired terms or ports that are never opened automatically.

Practice question

A company runs three indexers, two search heads and 600 universal forwarders. The admin wants a single Splunk instance that keeps the forwarders' inputs.conf and outputs.conf files consistent and lets new forwarders pull them automatically. Which component should the admin configure?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start by drawing a distributed deployment on one page: forwarders on the left, indexers in the middle, search heads on the right, and the management roles above them with arrows showing what each one controls. Label each arrow with its default port. This single diagram covers almost every Admin Basics question and becomes the map you reuse for later topics.

Next, install Splunk Enterprise and a universal forwarder in a lab, even on one laptop, and look at the different directory layouts and the smaller UF footprint. Open Settings in Splunk Web and find where the license manager, distributed search and forwarder management screens live.

Finally, drill the three coordinator roles until you never confuse them: deployment server for clients, deployer for search head cluster members and cluster manager for indexer peers. Flashcards work well here because the topic is recognition-based. Keep sessions short and move on, since the 5% weight does not justify deep study beyond solid identification.

FAQ

How much of SPLK-1003 is Splunk Admin Basics?

Splunk Admin Basics is 5% of the exam, about three of the 56 questions, with one official objective: identify Splunk components.

Do I need to know Splunk Cloud components?

The blueprint targets Splunk Enterprise administration. Focus on on-premises roles such as indexers, search heads, forwarders and management components.

Is the license master still tested by that name?

Current Splunk versions call it the license manager, and the cluster master is now the cluster manager. Learn both names but expect current terminology.

Can one Splunk instance hold several roles?

Yes. A single-instance deployment indexes and searches on the same host, and small sites often co-locate the license manager and Monitoring Console.

What is the difference between the deployer and the deployment server?

The deployer pushes configuration to search head cluster members. The deployment server distributes apps to deployment clients such as forwarders.

Did the Cisco acquisition change this exam?

The blueprint content is the same. Registration, exam history and support moved to Cisco's certification systems from 20 October 2026.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have reviewed Splunk processing and management components. Check that you can match a described job to the right role and port under time pressure.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going