Splunk Enterprise Certified Admin

Last checked November 10, 2026 against the official Splunk exam page.

1. Question 1Getting Data In and Configuring Forwarders

   A company must send data from 300 Linux servers to indexers while keeping the footprint on each server small. The servers need no local parsing or filtering. Which forwarder type fits this requirement?

   1. ASearch head with a forwarding output group, which runs searches and forwards the results
   2. BHeavy Forwarder, which parses events on each server and needs more resources
   3. CUniversal Forwarder, which has a small footprint and performs only the input phase
   4. DDeployment server, which pushes data inputs down to clients and forwards events to indexers
   Show answer and explanationHide answer

   Correct answer: C

   The Universal Forwarder is the lightweight option that only collects and forwards data, which matches the requirement for a small footprint without parsing. The Heavy Forwarder parses events locally, and search heads and deployment servers do not forward raw data as their role.

2. Question 2Splunk Admin Basics, License Management and Configuration Files

   An administrator runs btool on an indexer and sees a setting that is defined in both the default and local directories of the same app. Which rule decides the value that Splunk uses?

   1. AThe file with the most stanzas in it always wins, regardless of directory
   2. BThe value from the app that was installed most recently always wins
   3. CThe local directory overrides the default directory, and etc/system/local has the highest precedence
   4. DThe default directory always wins so that upgrades do not change behavior
   Show answer and explanationHide answer

   Correct answer: C

   Splunk layers configuration files so that a local copy overrides the same file in default, and system/local sits at the top of the precedence order. The other options invent rules based on file size, install date or upgrade safety, none of which Splunk uses.

3. Question 3Monitor, Network, Scripted and Agentless Inputs

   A team must receive syslog from network devices and wants to reduce the chance that events are silently lost in transit. Which input type should they configure?

   1. AA TCP input, because the protocol retransmits lost packets and so events are less likely to vanish
   2. BA UDP input, because the protocol guarantees that every packet reaches the indexer in order
   3. CA file monitor input, because the devices can be set to write their syslog to local files
   4. DA scripted input, because it polls each network device on a fixed schedule to collect logs
   Show answer and explanationHide answer

   Correct answer: A

   TCP provides reliable, ordered delivery with retransmission, which lowers the risk of dropped events compared with UDP. UDP does not guarantee delivery, and file monitor and scripted inputs are not the right choices for live syslog streams.

4. Question 4Fine Tuning Inputs, Parsing and Manipulating Raw Data

   An administrator wants events from one sourcetype routed to a separate index based on their content. The change must happen where parsing occurs, on an indexer or heavy forwarder. Which pair of configuration files and settings accomplishes this?

   1. Aprops.conf references a transform, and transforms.conf sets DEST_KEY to _MetaData:Index with a matching REGEX
   2. Bindexes.conf defines the new index, and inputs.conf renames the sourcetype so the events move
   3. Cserver.conf sets the routing rule, and outputs.conf defines a tcpout group for the new index
   4. Dlimits.conf sets the index size, and savedsearches.conf runs a scheduled search to copy events
   Show answer and explanationHide answer

   Correct answer: A

   Index routing is done in parsing by pointing a props.conf stanza at a transform in transforms.conf, where DEST_KEY set to _MetaData:Index picks the destination. Universal forwarders do not parse, and the other pairs do not route events at index time.

5. Question 5Splunk Indexes

   An engineer reviews an index's bucket directory and sees a bucket that is open for writes and receives every new incoming event. Which bucket type is this?

   1. ACold bucket, which is moved to slower storage for long-term retention
   2. BWarm bucket, which holds older data that is no longer written to
   3. CHot bucket, which is open for writes and holds the newest events
   4. DThawed bucket, which contains archived data that has been restored for searching
   Show answer and explanationHide answer

   Correct answer: C

   New events are written to hot buckets, which are the only buckets open for writes. Warm and cold buckets hold data that has already rolled out of the hot state, and thawed buckets hold restored archived data, so none of them receive new incoming events.