9.3 Splunk Input Options

Splunk Enterprise Certified Admin SPLK-1003

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the Splunk Enterprise Certified Admin Exam

2 Chapter 1: Splunk Admin Basics

1.1 Splunk Enterprise Architecture & Core Components

3 Chapter 2: License Management

2.1 License Types, Stacks, Pools & Licensing Architecture 2.2 License Violations, Rolling Window Warnings & Troubleshooting

4 Chapter 3: Splunk Configuration Files

3.1 Splunk Configuration Directory Structure 3.2 Configuration Layering, Precedence & Resolution Rules 3.3 Using btool to Inspect & Debug Configurations

5 Chapter 4: Splunk Indexes

4.1 Index Structure: Directories, Buckets & Bucket Files 4.2 Bucket Types & the Hot-Warm-Cold-Frozen-Thawed Lifecycle 4.3 Checking Index Data Integrity 4.4 indexes.conf Options: Paths, Bucket Sizing & Volumes 4.5 The Fishbucket: File Tracking, CRC Collisions & Re-reading Files 4.6 Applying a Data Retention Policy

6 Chapter 5: Splunk User Management

5.1 Splunk Roles, Capabilities & Custom Role Design 5.2 User Account Administration, Search Restrictions & Limits

7 Chapter 6: Splunk Authentication Management

6.1 Integrating Splunk with LDAP 6.2 Other Authentication Options & Enabling Multifactor Authentication

8 Chapter 7: Getting Data In

7.1 CLI Administration & Basic Data Onboarding Workflows 7.2 Forwarder Types: Universal Forwarder vs. Heavy Forwarder

9 Chapter 8: Distributed Search

8.1 How Distributed Search Works 8.2 Roles of the Search Head and Search Peers 8.3 Configuring Search Peers & Distributed Search Groups 8.4 Search Head Scaling & Search Head Clustering (SHC)

10 Chapter 9: Getting Data In – Staging

9.1 Ingestion Pipeline Stages: Input, Parsing, Merging, Typing & Indexing 9.2 Pipeline Component Placement & Queue Management 9.3 Splunk Input Options

11 Chapter 10: Configuring Forwarders

10.1 Forwarder Setup & outputs.conf Load Balancing 10.2 Indexer Acknowledgment, Data Cloning & Forwarder Routing

12 Chapter 11: Forwarder Management

11.1 Deployment Management & the Deployment Server 11.2 Deployment Apps & Deployment Clients 11.3 Server Classes, Client Grouping & App Deployment Strategies 11.4 Forwarder Management Monitoring & Troubleshooting

13 Chapter 12: Monitor Inputs

12.1 File & Directory Monitoring Mechanics 12.2 Monitor Input Tuning: Whitelists, Blacklists & CRC Settings 12.3 Deploying a Remote Monitor Input, Network Shares & Archives

14 Chapter 13: Network and Scripted Inputs

13.1 Creating Network Inputs: TCP & UDP 13.2 Optional Settings for Network Inputs 13.3 Scripted Inputs & PowerShell Data Collection

15 Chapter 14: Agentless Inputs

14.1 Windows Management Instrumentation (WMI) Inputs 14.2 HTTP Event Collector (HEC) Architecture & Administration

16 Chapter 15: Fine Tuning Inputs

15.1 Input-Phase Processing & Default Metadata Assignment 15.2 Character Set Encoding & Handling Binary Data

17 Chapter 16: Parsing Phase and Data

16.1 Line Breaking & Event Segmentation 16.2 Timestamp Extraction, Time Zones & Clock Skew Handling 16.3 Validating Event Parsing with Data Preview

18 Chapter 17: Manipulating Raw Data

17.1 Transformation Mechanics: props.conf & transforms.conf 17.2 Data Masking, Redaction & SEDCMD 17.3 Event Routing, Dynamic Index Assignment & Filtering to nullQueue

9.3 Splunk Input Options

Key Takeaways Explain This Topic AI

Common inputs include [monitor://] (files and directories), [batch://] with move_policy = sinkhole, [tcp://] and [udp://], [splunktcp://] (receiving from forwarders), [script://], and [http://<token>] for HEC.

Windows machines add WinEventLog, perfmon, WinRegMon, admon, WinHostMon, WinPrintMon, WinNetMon, MonitorNoHandle, and powershell inputs; remote agentless collection uses WMI in wmi.conf.

A universal forwarder can run monitor, batch, network, scripted, and Windows inputs (including remote WMI on Windows), but not HTTP Event Collector.

Splunk Web's Add Data offers Upload (one file), Monitor (local inputs), and Forward (inputs on deployment clients through the deployment server).

Every input sets host, source, sourcetype, and index; index defaults to main and TCP inputs set host by reverse DNS unless connection_host is changed.

Last updated: September 2026

Splunk Input Options

Blueprint objective 9.2 asks you to list Splunk input options . Every input is configured in inputs.conf (wmi.conf for WMI) or through Settings > Add Data and Settings > Data inputs in Splunk Web, and every input assigns the same metadata: host , source , sourcetype , and index . What differs is where the data comes from and which Splunk component can run the input.

The Input Families

Input family Stanza in inputs.conf What it collects Runs on a universal forwarder?

Files and directories (monitor) [monitor://<path>] Continuously tails files and directory trees, including rotated and compressed files Yes, the most common UF input

• Batch [batch://<path>] with move_policy = sinkhole Reads files once and deletes them (destructive loading) Yes
• Upload / oneshot Splunk Web Upload , or splunk add oneshot A single file indexed once Oneshot from the CLI

Network: TCP / UDP [tcp://<port>] , [udp://<port>] , [tcp-ssl:<port>] Raw data pushed over the network (syslog and similar) Yes

Splunk-to-Splunk receiving [splunktcp://<port>] , [splunktcp-ssl:<port>] Data from other Splunk forwarders (usually port 9997 on indexers) Used by intermediate forwarders

Scripted [script://<cmd>] Output of a script or program run on a schedule Yes (no bundled Python on a UF)

HTTP Event Collector (HEC) [http://<token_name>] plus the global [http] stanza JSON or raw events sent over HTTP/HTTPS with a token (port 8088 by default) No : heavy forwarder, indexer, or other full instance

Windows inputs [WinEventLog://<channel>] , [perfmon://<name>] , [WinRegMon://<name>] , [admon://<name>] , [WinHostMon://<name>] , [WinPrintMon://<name>] , [WinNetMon://<name>] , [MonitorNoHandle://<path>] , [powershell://<name>] Event logs, performance counters, registry, Active Directory, host, print, and network monitoring on the local Windows machine Yes (Windows UF)

Remote Windows via WMI [WMI:<name>] in wmi.conf Event logs or WQL queries from remote Windows machines, with no agent on the target Yes, on a Windows universal or heavy forwarder running as a domain user

FIFO queues [fifo://<path>] Data written to a named pipe Yes

Linux/macOS system logs [journald://<name>] , [logd://<name>] systemd journal (Linux) and unified logging (macOS) Yes

Modular inputs [<scheme>://<name>] defined by an app or add-on API-based and specialized sources (for example DB Connect, cloud services) Depends on the add-on; many need a heavy forwarder

How to Choose

Is the data in files on a host you can install software on? Use a universal forwarder with a monitor input. It keeps track of where it stopped reading, survives restarts, and can use indexer acknowledgment.

Is the data pushed over the network? For syslog, Splunk's usual design is a syslog server that writes to disk, with a UF monitoring those files. Direct udp / tcp inputs work, but data sent while the listener is down is lost.

Does an application prefer to send HTTP? Use HEC tokens on a full instance (often heavy forwarders behind a load balancer, or the indexers).

Does the data come from running a command or API? Use a scripted input or a modular input from an add-on.

Is the source a Windows server? Use the Windows inputs on a Windows UF. Use WMI only when you cannot install an agent on the target. WMI needs a Splunk instance on Windows, such as a universal or heavy forwarder running as a domain user, plus open RPC ports, and Splunk says its load often exceeds that of installing a forwarder.

Where Inputs Are Created

Splunk Web: Settings > Add Data offers Upload (one file), Monitor (files, directories, network ports, scripts, HEC, Windows inputs on the local instance), and Forward (configure inputs on deployment clients through the deployment server).

CLI: splunk add monitor , splunk add oneshot , splunk add tcp , splunk add udp , and so on. The CLI writes the stanza to an inputs.conf file.

Configuration files: write inputs.conf stanzas directly, usually inside an app or add-on, and deploy them to forwarders with the deployment server.

Metadata Defaults to Remember

• Metadata Default
• index default , which resolves to main
• host The instance's host name. Network inputs use connection_host ( dns for TCP, ip for UDP by default)
• source The file path, tcp:<port> / udp:<port> , the script path, or http:<token name> for HEC

sourcetype Whatever you set. Otherwise Splunk assigns one automatically, and for UDP with no source type the default is udp:<port>

Exam tip: When a question asks "which input type" for a scenario, match the source first (file, network port, script, HTTP, Windows API, or remote WMI), then check which component can run it. A universal forwarder cannot run HTTP Event Collector.