SPLK-1003 — Splunk Enterprise Certified Admin
Splunk

Splunk Enterprise Certified Admin (SPLK-1003) Practice Questions

★★★★★★ 4.6 104 verified reviews
171 questions
June 17, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Splunk Admin Basics (5%)
  • License Management (5%)
  • Splunk Configuration Files (15%)
  • Splunk Indexes (10%)
  • Users, Roles, and Authentication (5%)
  • Getting Data In - GDI (10%)
  • GDI - Staging & Monitoring (10%)
  • Forwarders & Management (15%)
  • Forwarder Management (10%)
  • Component Parsing & Distributed Search (15%)

Sample Questions (18 of 171 shown)

Q1 Manipulating Raw Data
Using SEDCMD in props.conf allows raw data to be modified. With the given event below, which option will mask the first three digits of the AcctID field? Event: [22/Oct/2018:15:50:21] VendorID=1234 Code=B AcctID=xxx5309
  1. s/VendorID=\\d{3}(\\d{4})/VendorID=xxx/g
  2. s/AcctID=\\d{3}(\\d{4})/AcctID=xxx/g
  3. s/AcctID=\\d{3}(\\d{4})/AcctID=\\1xxx/g
  4. s/AcctID=\\d{3}(\\d{4})/AcctID=xxx\\1/g
✓ Correct Answer: D
See Splunk documentation for details on this topic.
Q2 Manipulating Raw Data
Within props.conf, which stanzas are valid for data modification? (Choose all that apply.)
  1. [host::]
  2. [server::]
  3. [source::]
  4. [sourcetype::]
✓ Correct Answer: C,D
See Splunk documentation for details on this topic.
Q3 Manipulating Raw Data
In which Splunk configuration is SEDCMD used?
  1. props.conf
  2. inputs.conf
  3. indexes.conf
  4. transforms.conf
✓ Correct Answer: A
See Splunk documentation for details on this topic.
Q4 Manipulating Raw Data
Required stanza attributes when configuring transforms.conf to manipulate/remove events? (Choose all that apply.)
  1. REGEX, DEST, FORMAT
  2. REGEX, SRC_KEY, FORMAT
  3. REGEX, DEST_KEY, FORMAT
  4. REGEX, DEST_KEY, FORMATTING
✓ Correct Answer: A,B
See Splunk documentation for details on this topic.
Q5 Manipulating Raw Data
Which config files transform raw data ingested by Splunk? (Choose all that apply.)
  1. props.conf
  2. inputs.conf
  3. rawdata.conf
  4. transforms.conf
✓ Correct Answer: A,D
See Splunk documentation for details on this topic.
Q6 Manipulating Raw Data
What is the correct example to redact a plain-text password from raw events?
  1. In props.conf: [redact]
  2. In transforms.conf: [redact] with REGEX
  3. In props.conf: with REGEX
  4. In transforms.conf: with SEDCMD
✓ Correct Answer: B
See Splunk documentation for details on this topic.
Q7 Manipulating Raw Data
SSN (PII) data found in log events. Which config file and stanza pair will mask SSNs?
  1. props.conf with REX
  2. props.conf with REGEX
  3. transforms.conf with REX
  4. transforms.conf with REGEX and DEST_KEY=_raw
✓ Correct Answer: D
See Splunk documentation for details on this topic.
Q8 Parsing Phase and Data
What is the default value of LINE_BREAKER?
  1. \r\n
  2. ([\r\n]+)
  3. \r+\n+
  4. (\r\n+)
✓ Correct Answer: B
See Splunk documentation for details on this topic.
Q9 Parsing Phase and Data
For single-line event sourcetypes, SHOULD_LINEMERGE should be set to:
  1. True
  2. False
  3. <regex string>
  4. Newline Character
✓ Correct Answer: B
See Splunk documentation for details on this topic.
Q10 Monitor Inputs
What is the supported method of filtering whitelists/blacklists for monitor inputs?
  1. Slash notation
  2. Regular expression
  3. Irregular expression
  4. Wildcard-only expression
✓ Correct Answer: B
See Splunk documentation for details on this topic.
Q11 Monitor Inputs
Valid option for a [monitor] stanza in inputs.conf? (Choose all that apply.)
  1. enabled
  2. datasource
  3. server_name
  4. ignoreOlderThan
✓ Correct Answer: A,D
See Splunk documentation for details on this topic.
Q12 Forwarder Management
When deploying apps on UFs using DS, what is the correct location of the app before deployment?
  1. On DS, $SPLUNK_HOME/etc/deployment-apps
  2. On UF, $SPLUNK_HOME/etc/apps
  3. On DS, $SPLUNK_HOME/etc/apps
  4. On UF, $SPLUNK_HOME/etc/deployment-apps
✓ Correct Answer: A
See Splunk documentation for details on this topic.
Q13 Forwarder Management
How do you remove missing forwarders from the Monitoring Console?
  1. Restart Splunk.
  2. Rescan active forwarders.
  3. Reload the deployment server.
  4. Rebuild the forwarder asset table.
✓ Correct Answer: D
See Splunk documentation for details on this topic.
Q14 Forwarder Management
A new forwarder has manually created deploymentclient.conf. What's the next step?
  1. Restart Splunk on DS.
  2. Enable deployment client in Splunk Web.
  3. Restart Splunk on deployment client.
  4. Wait for phoneHomeIntervalInSecs.
✓ Correct Answer: C
See Splunk documentation for details on this topic.
Q15 Forwarder Management
When deploying apps, which attribute determines the apps clients install?
  1. App Class
  2. Client Class
  3. Server Class
  4. Forwarder Class
✓ Correct Answer: C
See Splunk documentation for details on this topic.
Q16 Forwarder Management
How does Monitoring Console monitor forwarders?
  1. Pulling internal logs from forwarders.
  2. Using forwarder monitoring add-on.
  3. With internal logs forwarded by forwarders.
  4. With internal logs forwarded by deployment server.
✓ Correct Answer: C
See Splunk documentation for details on this topic.
Q17 Forwarder Management
On the deployment server, which statement about client filters is accurate?
  1. Blacklist takes precedence over whitelist.
  2. Whitelist takes precedence over blacklist.
  3. Wildcards not supported.
  4. Machine type filters applied before whitelist/blacklist.
✓ Correct Answer: A
See Splunk documentation for details on this topic.
Q18 Forwarder Management
Where are deployment server apps mapped to clients?
  1. Apps tab or clientapps.conf
  2. Clients tab or deploymentclient.conf
  3. Server Classes tab or serverclass.conf
  4. Client Applications tab or clientapps.conf
✓ Correct Answer: C
See Splunk documentation for details on this topic.

You've viewed 3 of 171 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

The Splunk Enterprise Certified Admin (SPLK-1003) certification targets professionals who manage Splunk platform configurations, licensing, data ingestion pipelines, and distributed search architectures. This professional-level exam is administered by Splunk through Pearson VUE (online proctored via OnVUE or at an authorized test center) and requires candidates to hold an active Splunk Core Certified Power User (SPLK-1002) certification as a prerequisite.

Splunk requires completion of two official training tracks on the STEP portal: Splunk Enterprise System Administration and Splunk Enterprise Data Administration. Candidates should also accumulate at least 3 to 6 months of active hands-on administration experience in a production or staging environment, and thoroughly study the Admin Manual, Getting Data In Manual, and Configuration File Reference Guide before attempting the exam.

The SPLK-1003 exam is organized around 10 operational domains, with the highest weights placed on Configuration Files (15%), Forwarders & Management (15%), and Component Parsing & Distributed Search (15%). Core technical knowledge areas include configuration file precedence (System > App > User context order, local overrides default), lifecycle mechanics of indexes.conf with Hot/Warm/Cold/Frozen buckets, the Universal Forwarder vs. Heavy Forwarder distinction, and props.conf/LINE_BREAKER event break configuration. The splunk btool command-line utility is the primary diagnostic tool tested throughout the exam.

For candidates preparing for the SPLK-1003 exam, our practice materials cover all 10 weighted domains in the same proportions as the real test — from Splunk Admin Basics and License Master/pool/stack configuration through Configuration Files with btool and precedence layering (default vs. local directories), Indexes with indexes.conf bucket lifecycle management, Getting Data In (GDI) covering Input/Parsing/Indexing phases and inputs.conf monitor configuration, Forwarders distinguishing Universal Forwarders from Heavy Forwarders with Deployment Server and Server Classes, and Component Parsing with props.conf and LINE_BREAKER for timezone and event break adjustments. Each online practice question includes a detailed answer explanation that walks through the administrative reasoning and Splunk configuration syntax, while the downloadable PDF packages the same question bank for offline review during commutes or in environments without stable internet.

Start your free SPLK-1003 practice test today and build confidence managing Splunk configurations, forwarder deployments, and data ingestion.

Official Exam Domains & Weighting

To successfully pass the SPLK-1003 exam, candidates must master the following core domains:
  • Domain 1: Splunk Admin Basics (5%)
Covers identifying core processing components (Indexers, Search Heads, Forwarders) and tracking general operational health of standalone or distributed Splunk installations.
  • Domain 2: License Management (5%)
Focuses on configuring License Masters, pools, and license stacks, understanding license types (Enterprise, Free, Forwarder), and identifying consequences of license warnings and ingestion violations.
  • Domain 3: Splunk Configuration Files (15%)
Tests navigating default vs. local directory locations, mastering disk precedence layers and execution ordering across system, app, and user contexts, and using the splunk btool command to troubleshoot layered configurations.
  • Domain 4: Splunk Indexes (10%)
Covers internal event storage structure and bucket lifecycles (Hot, Warm, Cold, Frozen, Thawed), plus configuring directory pathways and retention policies in indexes.conf.
  • Domain 5: Users, Roles, and Authentication (5%)
Addresses mapping capabilities and permission scopes to custom Splunk Roles and troubleshooting external authentication links (LDAP, SAML, Active Directory).
  • Domain 6: Getting Data In - GDI (10%)
Explains differentiating Input, Parsing, and Indexing processing phases with metadata assignment locations, and using data previewing layouts to review event break configurations before indexing.
  • Domain 7: GDI - Staging & Monitoring (10%)
Tests implementing custom file and directory monitor inputs via inputs.conf and managing dynamic host and source-type assignments across incoming data streams.
  • Domain 8: Forwarders & Management (15%)
Covers distinguishing Universal Forwarders (lightweight, no parsing) from Heavy Forwarders (full Splunk instance with parsing and routing capabilities) and installing/configuring UFs via CLI.
  • Domain 9: Forwarder Management (10%)
Focuses on configuring Deployment Servers, building Server Classes, handling deployment apps, and troubleshooting client connection heartbeats and data payload distribution.
  • Domain 10: Component Parsing & Distributed Search (15%)
Addresses configuring event break parameters (LINE_BREAKER) and timezone adjustments in props.conf, plus understanding distributed search architectures with search head to index peer mapping.

What Our Customers Say 104 verified reviews

4.6 ★★★★★★ Based on 104 reviews
★★★★★★
Excellent SPLK-1003 question bank! The explanations teach you the concepts, not just the answers. Well worth the price.
— Amanda P.
★★★★★
Was on the fence about buying the SPLK-1003 practice test, but man am I glad I did. Nailed my certification today.
— Tyler M.
★★★★★★
I studied for SPLK-1003 with this bank and passed comfortably. The questions are well-organized and the UI is clean.
— Lauren C.
★★★★★
Passed SPLK-1003 with 94%. If you’re serious about this certification, get this question bank and thank me later.
— Hunter P.
★★★★★★
Between the SPLK-1003 practice questions and some hands-on labs, I felt fully prepared walking into the exam center.
— Caleb B.
★★★★★★
I was struggling with SPLK-1003 until I found this. The domain-based organization and instant feedback helped me identify weak areas quickly.
— David L.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

Configuration File Precedence. The exam presents scenario questions asking which setting takes effect when an identical parameter exists across multiple directories. The rule is that local always overrides default, and runtime directory precedence follows System > App > User context order. Our practice materials include multiple precedence-based exercises with btool diagnostic walkthroughs.

If you exceed your daily indexed volume beyond the warning threshold, Splunk does not stop indexing — data ingestion continues normally. However, your ability to execute ad-hoc searches is temporarily locked until the violation state resolves or resets. Our practice questions cover this license warning mechanism with scenario-based drills.

A Universal Forwarder (UF) is lightweight, consumes minimal CPU/RAM, and cannot parse raw events or execute complex regex. A Heavy Forwarder (HF) is a full Splunk Enterprise instance that can parse, anonymize data, route events, and save localized index copies. Our practice sets include deployment-scenario questions that test UF vs. HF capability trade-offs.

The splunk btool command-line utility. Candidates must know how to debug active on-disk configurations (e.g., splunk btool inputs list --debug) to see which file layer added a specific parameter. Our practice materials include btool syntax exercises.

Our mock exam covers all 10 domains with the same weight distribution as the real test — from License Master configuration and config file precedence scenarios through UF vs. HF forwarder deployment decisions, indexes.conf bucket lifecycle questions, inputs.conf monitor setup, props.conf LINE_BREAKER parsing, and Deployment Server/Server Class management. Each question includes a detailed administrative reasoning explanation.

Yes. The downloadable PDF contains the same question bank as the online version, including answer explanations covering configuration file precedence rules (default vs. local, System > App > User order), btool diagnostic commands, indexes.conf bucket state transitions, GDI Input/Parsing/Indexing phase distinctions, and forwarder deployment topologies. It is designed for offline study without an internet connection.

Candidates report Configuration Files (15%), Forwarders & Management (15%), and Component Parsing & Distributed Search (15%) as the most demanding — each carries the highest weight and involves nuanced decision-making. Understanding config precedence layering is particularly tricky because identical parameters can appear across default/, local/, and app-specific directories. Our practice questions include focused drills on these high-weight domains.