Study guide
About the Splunk Enterprise Certified Admin Exam
Splunk Enterprise Certified Admin SPLK-1003
Track your progress as you read
Finished sections get a check mark.
1 Introduction
About the Splunk Enterprise Certified Admin Exam
2 Chapter 1: Splunk Admin Basics
1.1 Splunk Enterprise Architecture & Core Components
3 Chapter 2: License Management
2.1 License Types, Stacks, Pools & Licensing Architecture 2.2 License Violations, Rolling Window Warnings & Troubleshooting
4 Chapter 3: Splunk Configuration Files
3.1 Splunk Configuration Directory Structure 3.2 Configuration Layering, Precedence & Resolution Rules 3.3 Using btool to Inspect & Debug Configurations
5 Chapter 4: Splunk Indexes
4.1 Index Structure: Directories, Buckets & Bucket Files 4.2 Bucket Types & the Hot-Warm-Cold-Frozen-Thawed Lifecycle 4.3 Checking Index Data Integrity 4.4 indexes.conf Options: Paths, Bucket Sizing & Volumes 4.5 The Fishbucket: File Tracking, CRC Collisions & Re-reading Files 4.6 Applying a Data Retention Policy
6 Chapter 5: Splunk User Management
5.1 Splunk Roles, Capabilities & Custom Role Design 5.2 User Account Administration, Search Restrictions & Limits
7 Chapter 6: Splunk Authentication Management
6.1 Integrating Splunk with LDAP 6.2 Other Authentication Options & Enabling Multifactor Authentication
8 Chapter 7: Getting Data In
7.1 CLI Administration & Basic Data Onboarding Workflows 7.2 Forwarder Types: Universal Forwarder vs. Heavy Forwarder
9 Chapter 8: Distributed Search
8.1 How Distributed Search Works 8.2 Roles of the Search Head and Search Peers 8.3 Configuring Search Peers & Distributed Search Groups 8.4 Search Head Scaling & Search Head Clustering (SHC)
10 Chapter 9: Getting Data In – Staging
9.1 Ingestion Pipeline Stages: Input, Parsing, Merging, Typing & Indexing 9.2 Pipeline Component Placement & Queue Management 9.3 Splunk Input Options
11 Chapter 10: Configuring Forwarders
10.1 Forwarder Setup & outputs.conf Load Balancing 10.2 Indexer Acknowledgment, Data Cloning & Forwarder Routing
12 Chapter 11: Forwarder Management
11.1 Deployment Management & the Deployment Server 11.2 Deployment Apps & Deployment Clients 11.3 Server Classes, Client Grouping & App Deployment Strategies 11.4 Forwarder Management Monitoring & Troubleshooting
13 Chapter 12: Monitor Inputs
12.1 File & Directory Monitoring Mechanics 12.2 Monitor Input Tuning: Whitelists, Blacklists & CRC Settings 12.3 Deploying a Remote Monitor Input, Network Shares & Archives
14 Chapter 13: Network and Scripted Inputs
13.1 Creating Network Inputs: TCP & UDP 13.2 Optional Settings for Network Inputs 13.3 Scripted Inputs & PowerShell Data Collection
15 Chapter 14: Agentless Inputs
14.1 Windows Management Instrumentation (WMI) Inputs 14.2 HTTP Event Collector (HEC) Architecture & Administration
16 Chapter 15: Fine Tuning Inputs
15.1 Input-Phase Processing & Default Metadata Assignment 15.2 Character Set Encoding & Handling Binary Data
17 Chapter 16: Parsing Phase and Data
16.1 Line Breaking & Event Segmentation 16.2 Timestamp Extraction, Time Zones & Clock Skew Handling 16.3 Validating Event Parsing with Data Preview
18 Chapter 17: Manipulating Raw Data
17.1 Transformation Mechanics: props.conf & transforms.conf 17.2 Data Masking, Redaction & SEDCMD 17.3 Event Routing, Dynamic Index Assignment & Filtering to nullQueue
About the Splunk Enterprise Certified Admin Exam
Key Takeaways Explain This Topic AI
The exam has 56 questions in 60 minutes, including 3 minutes to accept the exam agreement, and is a professional-level exam delivered by Pearson VUE in person or online.
The prerequisite is Splunk Core Certified Power User, and each attempt costs $130 USD, or five registrations cost $500 USD.
The blueprint has 17 domains: Splunk Indexes, Distributed Search, and Forwarder Management are 10% each, and the other 14 domains are 5% each.
After a failed attempt, the wait is 7 days, then 14 days, then 28 days before a fourth attempt and 56 days before a fifth or sixth.
The certification lasts three years; recertify by passing the exam again in the final year or by passing Splunk Enterprise Certified Architect, since coursework no longer counts after 1 March 2026.
Last updated: September 2026
About the Splunk Enterprise Certified Admin Exam
Quick Summary: The Splunk Enterprise Certified Admin exam is the final step to the Splunk Enterprise Certified Admin certification. It is a professional-level , closed-book exam of 56 questions in 60 minutes (including 3 minutes to accept the exam agreement), delivered by Pearson VUE. The prerequisite is Splunk Core Certified Power User . Its blueprint has 17 domains : 14 are weighted 5% each, and three (Splunk Indexes, Distributed Search, and Forwarder Management) are weighted 10% each. This independent ExamFinch guide follows the same 17 domains, one chapter per domain.
The Exam at a Glance
- Item Detail
- Questions 56
- Time 60 minutes, which includes 3 minutes to review and accept the Splunk Certification Agreement
- Level Professional
- Prerequisite certification Splunk Core Certified Power User
- Registration fee $130 USD per attempt, or five registrations for $500 USD
- Delivery In person at a Pearson VUE test center, or at home with an online proctor (OnVUE)
- Reference material None: exams are closed book, and any perceived violation means automatic failure
Results Pass or fail. Unsuccessful candidates can view section feedback in their Pearson account; no question-by-question analysis is given
- Certification validity Three years
- Next-level certification Splunk Enterprise Certified Architect
During the exam you can flag questions for review, return to earlier questions, and review everything before submitting. Once submitted, scores are final.
Scheduling, Retakes, and Recertification
Cancelling or rescheduling: you must do so at least 48 hours before the appointment, or you forfeit the fee. Online candidates must pass Pearson's system test on the computer they will use.
Retake waits: 7 days after a first failed attempt, 14 days after a second, 28 days before a fourth attempt, and 56 days before a fifth or sixth. Attempts beyond the sixth are considered case by case. Each attempt costs the full fee, and you cannot retake an exam you have passed except for recertification.
Recertification: certifications last three years from the date you earned your highest-level certification. You can recertify by passing the same exam again in the final year of the cycle, or by passing a higher-level certification ; for this certification that is Splunk Enterprise Certified Architect. There is a 90-day grace period, after which the certification becomes inactive. Renewing the Admin certification also renews the downstream Power User certification. It also updates the Core Certified User and Advanced Power User badges, but only if you already hold them.
Policy change: Splunk removed the option to recertify by completing coursework, effective 1 March 2026 .
Blueprint Map: Domains, Weights, and Chapters
With 56 questions, a 5% domain is worth about 3 questions and a 10% domain about 5 or 6. These are our own approximations; Splunk publishes only the percentages.
- Domain Weight ≈ Questions Chapter in this guide
- 1.0 Splunk Admin Basics 5% 3 Chapter 1
- 2.0 License Management 5% 3 Chapter 2
- 3.0 Splunk Configuration Files 5% 3 Chapter 3
- 4.0 Splunk Indexes 10% 5–6 Chapter 4
- 5.0 Splunk User Management 5% 3 Chapter 5
- 6.0 Splunk Authentication Management 5% 3 Chapter 6
- 7.0 Getting Data In 5% 3 Chapter 7 (7.3 in Chapter 10)
- 8.0 Distributed Search 10% 5–6 Chapter 8
- 9.0 Getting Data In – Staging 5% 3 Chapter 9
- 10.0 Configuring Forwarders 5% 3 Chapter 10
- 11.0 Forwarder Management 10% 5–6 Chapter 11
- 12.0 Monitor Inputs 5% 3 Chapter 12
- 13.0 Network and Scripted Inputs 5% 3 Chapter 13
- 14.0 Agentless Inputs 5% 3 Chapter 14
- 15.0 Fine Tuning Inputs 5% 3 Chapter 15
- 16.0 Parsing Phase and Data 5% 3 Chapter 16
- 17.0 Manipulating Raw Data 5% 3 Chapter 17
The blueprint says its topics are general guidelines, that related topics may also appear, and that the guidelines can change without notice. Check the current blueprint PDF before your exam.
How to Use This Guide
Weight your time by the blueprint. The three 10% domains together are 30% of the exam: bucket lifecycle and retention, distributed search and search head clustering, and deployment server management. Give them extra practice.
Follow the data. Chapters 7 and 9–17 follow data from input, through forwarding and the parsing, merging, typing, and index pipelines, to transformation. Knowing which tier applies which setting (universal forwarder, heavy forwarder, indexer, or search head) answers many questions.
Learn the files and their defaults. Many questions turn on a setting name or default, such as inputs.conf , outputs.conf , props.conf , transforms.conf , indexes.conf , serverclass.conf , or authorize.conf . Each chapter shows the real stanza syntax.
Practice hands-on. A small lab (a Splunk Enterprise instance plus a universal forwarder) lets you try btool , deployment apps, monitor inputs, and props/transforms changes yourself.
Use the official preparation list. The blueprint suggests the Splunk Enterprise System Administration and Data Administration courses, and says candidates may also use the Splunk How-To YouTube channel, Splunk Docs, and their own experience.
Each section ends with practice questions that explain why the right answer is right, using the facts taught in that section.