SPLK-1003 · Domain 5 of 17

SPLK-1003 Domain 5: Splunk User Management

User Management covers Splunk's role-based access model: what the built-in roles allow, how to build a custom role with capabilities, inheritance and index restrictions, and how native Splunk users are created and assigned roles.

Exam weight
5%
Official objectives
3
Estimated questions estimate
~3
Suggested study time estimate
3–5 hrs

About 9 min read Reviewed October 2026

Overview

Domain 5 has three official objectives: describe user roles in Splunk, create a custom role and add Splunk users. Roles bundle capabilities, such as scheduling searches or editing inputs, with index access, search filters and resource quotas. Built-in roles include admin, power, user and can_delete. Custom roles are usually created by inheriting from an existing role and adding what is missing. Users are then created in Splunk's native authentication store or mapped from an external system and assigned one or more roles.

At 5%, plan for about three questions. Expect items on inheritance behaviour, the difference between allowed and default indexes, and which role is needed to run the delete command. Settings live in authorize.conf, which links this topic to configuration precedence.

How it's tested

Questions describe a team's needs and ask which role setup meets them, or show a role definition and ask what a user can do. Watch for inheritance and index access details, since those decide most answers in this topic and catch many prepared candidates.

  • Design the role

    A team needs specific search, index or scheduling rights and you choose the role configuration that fits.

  • Inheritance outcome

    A child role inherits from a parent and you decide which capabilities and indexes the child effectively has.

  • Who can delete

    You identify the role or capability required to run the delete command against indexed data.

Reasoning it through

Analysts must search only the web index and should not schedule searches. Inheriting from power would grant scheduling that cannot be removed, so the candidate inherits from user instead, sets srchIndexesAllowed to web and srchIndexesDefault to web. A choice that inherits from power and tries to disable schedule_search would fail, because inherited capabilities cannot be taken away.

Objectives 3

Official objectives from the Splunk outline, in outline order.

5.1 Describe user roles in SplunkBuilt-in roles and what a role contains.
What it means
A role is a named set of permissions. It defines capabilities, the indexes users may search, indexes searched by default, search filters, time-range limits and quotas for concurrent searches and disk space. Splunk ships admin, power, user and can_delete roles; power extends user, and admin extends power.
What to understand
user can run searches and create knowledge objects in its own space. power adds sharing and scheduling abilities. admin can configure the instance. can_delete holds only the delete_by_keyword capability, which no other role has by default, including admin. A user's effective rights are the union of all assigned roles.
How it shows up
A required ability is described and you choose the built-in role that provides it.
Common confusion
Thinking admin can run the delete command without being given can_delete.
5.2 Create a custom roleCapabilities, inheritance, index access and restrictions.
What it means
Custom roles are created in Settings, Roles or in authorize.conf. You choose roles to inherit from, add capabilities, set srchIndexesAllowed and srchIndexesDefault, and optionally add a search filter (srchFilter), a search time window and quotas such as srchJobsQuota and srchDiskQuota.
What to understand
Inheritance adds everything from the parent and cannot be subtracted, so start from the least-privileged parent. Allowed indexes control what can be searched; default indexes control what is searched when no index is specified. Search filters restrict results further by field values. Role names must be lowercase.
How it shows up
You configure a role to give a group exactly the access described, using inheritance and index settings.
Common confusion
Expecting to remove an inherited capability or index from a child role.
5.3 Add Splunk usersCreating native users and assigning roles.
What it means
Native users are created in Settings, Users or with the CLI command splunk add user, giving a username, password, roles and optional default app and time zone. Native user records are stored in $SPLUNK_HOME/etc/passwd. The initial admin account is created at install time, for example from user-seed.conf.
What to understand
Assign the least-privileged role that meets the need, and remember a user can hold several roles. Users from LDAP or SAML are not created here; their access comes from group-to-role mapping. Native accounts take precedence over external accounts with the same name.
How it shows up
You choose the steps or command for adding a user with a given role and defaults.
Common confusion
Trying to create LDAP users manually instead of mapping their groups to roles.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Role

    A named bundle of capabilities, index access, filters and quotas.

    Remember
    Users get the union of all assigned roles.
    Tested as
    Role design questions.
    Trap
    Thinking only one role can be assigned.

  • user role

    Basic searching and private knowledge objects.

    Remember
    Least-privileged built-in parent.
    Tested as
    Custom role parent choice.
    Trap
    Starting restricted roles from power.

  • power role

    Adds sharing and scheduling of searches.

    Remember
    Inherits from user.
    Tested as
    Capability questions.
    Trap
    Assuming it can configure inputs.

  • admin role

    Full administrative capabilities.

    Remember
    Still lacks delete_by_keyword by default.
    Tested as
    Delete questions.
    Trap
    Assuming admin can delete data.

  • can_delete

    Holds the delete_by_keyword capability.

    Remember
    delete only marks events unsearchable; disk space is not freed.
    Tested as
    Delete command items.
    Trap
    Thinking delete reclaims storage.

  • Inheritance

    Child roles receive parent capabilities and indexes.

    Remember
    Inherited items cannot be removed.
    Tested as
    Inheritance outcome questions.
    Trap
    Unchecking inherited capabilities.

  • srchIndexesAllowed

    Indexes a role may search.

    Remember
    Controls access.
    Tested as
    Index restriction questions.
    Trap
    Confusing it with default indexes.

  • srchIndexesDefault

    Indexes searched when no index is given.

    Remember
    Controls convenience, not access.
    Tested as
    Missing-data scenarios.
    Trap
    Using it to restrict access.

  • srchFilter

    A search restriction added to every search by the role.

    Remember
    Limits results by field values.
    Tested as
    Row-level restriction questions.
    Trap
    Treating it as index access.

  • authorize.conf

    File where roles are defined.

    Remember
    Users live in etc/passwd for native auth.
    Tested as
    Configuration location items.
    Trap
    Looking for roles in authentication.conf.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Built-in roles

ConceptMeaningKey differenceCommon trap
user Basic search Least privileged Using power as a restricted parent
power Search plus sharing and scheduling Inherits user Expecting admin rights
admin Full configuration No delete capability by default Assuming it can delete
can_delete Delete command only Grants delete_by_keyword Thinking delete frees disk

Index access settings

ConceptMeaningKey differenceCommon trap
srchIndexesAllowed Which indexes can be searched Access control Using default list to restrict
srchIndexesDefault Indexes searched without index= Convenience Assuming it grants access
srchFilter Extra search restriction Filters by field values Confusing with index lists

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Remove inherited capability

    What candidates pick
    Disable schedule_search on a role that inherits from power.
    Why it looks right
    The UI shows the capability in the list.
    Why it's wrong
    Inherited capabilities cannot be removed; choose a less-privileged parent instead.

    Clue to watch for The role must have fewer rights than its parent.

  2. Default means allowed

    What candidates pick
    Set srchIndexesDefault to grant access to a new index.
    Why it looks right
    Users then see data from it.
    Why it's wrong
    Access depends on srchIndexesAllowed; default indexes only apply when no index is specified.

    Clue to watch for Users cannot search the index explicitly.

  3. Admin can delete

    What candidates pick
    Assume an admin can run the delete command.
    Why it looks right
    Admin seems all-powerful.
    Why it's wrong
    delete_by_keyword belongs only to can_delete, which must be assigned explicitly.

    Clue to watch for The delete command returns a permission error.

  4. Delete frees space

    What candidates pick
    Use delete to reclaim disk.
    Why it looks right
    Deleting sounds permanent.
    Why it's wrong
    The delete command only hides events from search; storage is not reclaimed.

    Clue to watch for The goal is recovering disk space.

  5. One role per user

    What candidates pick
    Create a combined role for a user who needs two sets of rights.
    Why it looks right
    Single assignment seems simpler.
    Why it's wrong
    Users can hold several roles and receive the union of their permissions.

    Clue to watch for The user needs rights from two existing roles.

Answer framework

Work through these steps when a question asks you to design or evaluate a Splunk role.

  1. List exactly what the users must do, such as which indexes to search, whether to schedule searches and whether to configure anything.
  2. Choose the least-privileged parent role, remembering that inheritance only adds and never removes capabilities or indexes.
  3. Set srchIndexesAllowed for access and srchIndexesDefault for convenience, and add a search filter if results must be limited further.
  4. Add quotas or time-window limits if the scenario mentions resource use, and grant can_delete only when the delete command is explicitly needed.
  5. Assign the role to native users or to mapped external groups, and confirm effective rights as the union of every role held.

Practice question

A new team must search only the payments index and should not be able to schedule searches. An admin creates a role that inherits from power, then unchecks schedule_search and sets srchIndexesAllowed to payments. Why does this design fail?

Want more like this? The SPLK-1003 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Learn the role model as layers: capabilities, index access, filters and quotas, all wrapped in an inheritance chain. Write the built-in chain user, power, admin on a card with two or three defining capabilities for each, and add can_delete beside it with a note that nobody has it by default.

In a lab, create a custom role that inherits from user, restrict it to one index and add a search filter. Create a native user with that role and log in as them to see what they can and cannot search. Then create a second role inheriting from power and try to uncheck an inherited capability, which shows the inheritance rule better than any description.

Open authorize.conf afterwards to see how Splunk Web wrote the role. Finish with scenario practice that asks you to design roles for described teams, checking each answer for inheritance mistakes and confusion between allowed and default indexes, which are the most common reasons for wrong answers in this topic.

FAQ

How much of SPLK-1003 is Splunk User Management?

Splunk User Management is 5% of the exam, about three questions, covering roles, custom roles and adding users.

Can a child role remove a capability it inherits?

No. Inheritance only adds. To restrict a role, inherit from a less-privileged parent or from no role at all.

What is the difference between allowed and default indexes?

Allowed indexes set what a role may search. Default indexes are searched when a query names no index.

Why can't admin run the delete command?

delete_by_keyword is assigned only to the can_delete role. Grant that role explicitly to the users who need it.

Where are roles and native users stored?

Roles are defined in authorize.conf. Native user accounts are stored in $SPLUNK_HOME/etc/passwd.

Can one user have several roles?

Yes. Effective permissions are the combination of everything granted by all assigned roles.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have studied built-in roles, custom role design and adding users. See whether you can spot inheritance and index access mistakes quickly.

Take the SPLK-1003 practice test Check your SPLK-1003 readiness

Keep going