Splunk Enterprise Certified Admin cheat sheet

Splunk Enterprise core roles are forwarders, indexers, and search heads; indexers store and search data, while search heads coordinate searches across search peers.

A universal forwarder is lightweight and does not index; a heavy forwarder is a full Splunk instance that can parse, filter, route, and optionally index data.

Default ports: Splunk Web 8000, management/REST 8089, and Splunk-to-Splunk data receiving 9997.

The data pipeline stages are input, parsing, indexing, and search; props.conf and transforms.conf influence parsing and routing.

A deployment server distributes apps and configurations to forwarders; a license master manages licensing; a cluster master manages indexer clusters.

In small deployments, management roles such as license master and deployment server can coexist on one Splunk instance.

Search heads send distributed searches to indexers listed as search peers and merge the results for the user.

Buckets are the physical units of indexed data and move through hot, warm, cold, and frozen states.

The license master stores license entitlements and aggregates license usage from distributed Splunk nodes.

Splunk licensed volume is based on the amount of raw uncompressed data indexed per day.

License pools allocate a portion of total licensed indexing volume to specific indexes or index groups.

License types include Enterprise, Trial, and Free; the Free license allows 500 MB per day and does not support distributed search or user authentication.

A license slave reports usage to the license master; if the master is unreachable, the slave continues indexing but logs warnings.

License usage can be reviewed in Settings > Licensing > Usage report, grouped by index, source, sourcetype, or host.

CLI commands for licensing include splunk list licenser-pools, splunk show license, and splunk add licenses.

Exceeding licensed daily volume can produce license warnings and, over time, a license violation.

For app-level configuration, precedence is etc/system/local, then app local, then app default, then etc/system/default.

btool shows the merged configuration and identifies the file and line providing each effective setting.

inputs.conf defines data inputs; outputs.conf defines forwarding destinations; props.conf and transforms.conf control parsing and field extraction.

indexes.conf defines index paths, bucket sizing, and retention; it is read by indexers.

server.conf contains server identity, clustering, licensing, and pass4SymmKey settings.

authorize.conf defines roles and capabilities; authentication.conf defines authentication methods.

Files in a local directory override files in a default directory within the same app context.

Some configuration changes require a restart, while others can be applied with a reload or through the UI.

Roles define capabilities and index access; users receive permissions through their assigned roles.

Default roles include admin, power, user, and can_delete.

A role can inherit capabilities and index permissions from one or more parent roles.

authorize.conf defines roles, inherited roles, capabilities, and index access.

authentication.conf defines authentication settings, including LDAP group-to-role mapping.

SAML authentication requires an identity provider and metadata exchange, with settings stored in saml.conf.

CLI user management commands include splunk add user, splunk edit user, splunk list user, and splunk remove user.

Search filters can restrict the results a role sees during searches.

Indexes store data in buckets; common default indexes include main, _internal, _audit, and _introspection.

Bucket lifecycle is hot, warm, cold, then frozen; frozen buckets are deleted or archived based on retention settings.

indexes.conf settings include homePath, coldPath, thawedPath, maxDataSize, maxHotBuckets, frozenTimePeriodInSecs, and maxTotalDataSizeMB.

Hot and warm buckets reside under homePath; cold buckets reside under coldPath; restored archives use thawedPath.

splunk add index and splunk list index manage indexes from the CLI.

splunk clean eventdata deletes indexed data from a specified index and is irreversible.

Indexer clustering distributes indexes.conf through the cluster bundle from the cluster master.

SmartStore can store bucket data in remote object storage while keeping metadata locally.

Common input types include file and directory monitors, network inputs, HTTP Event Collector, scripted inputs, and modular inputs.

inputs.conf monitor stanzas use syntax such as [monitor:///var/log] with disabled=false and an optional sourcetype.

The HTTP Event Collector listens on port 8088 by default and authenticates requests with tokens.

Splunk-to-Splunk receiving uses port 9997 and the splunktcp input.

crcSalt changes file CRC calculation so renamed or moved files are treated as new data.

ignoreOlderThan prevents monitoring of files older than a specified age.

oneshot input indexes a single file once and is useful for testing.

INDEXED_EXTRACTIONS in props.conf enables structured data extraction for formats such as CSV, JSON, and XML.

A search head uses distsearch.conf and the Distributed Search settings to define search peers.

A deployment client uses deploymentclient.conf to locate its deployment server.

serverclass.conf defines server classes, client filters, and the apps each class receives.

splunk reload deploy-server reloads deployment server configuration.

outputs.conf tcpout stanzas define forwarding groups and indexer server lists.

useACK=true enables indexer acknowledgement for reliable forwarding.

splunk list forward-server shows configured forwarding destinations.

Search head clustering uses a deployer to distribute apps and configurations to search head cluster members.

The Monitoring Console provides health checks, performance dashboards, license usage, indexing, and search activity views.

The _internal index contains Splunk component logs, including splunkd.log and metrics.log.

The _audit index contains audit events for user and configuration activity.

splunkd.log is stored under $SPLUNK_HOME/var/log/splunk.

splunk diag collects logs, configurations, and system information into a diagnostic file.

splunk health and the server health endpoint report component health.

Metrics data can be searched in index=_internal source=*metrics.log.

Monitoring Console can run in standalone or distributed mode and be configured with search peers.

Apps extend Splunk with searches, dashboards, reports, and configurations; add-ons typically provide inputs, parsing, or field extractions.

App files reside under $SPLUNK_HOME/etc/apps/ with default and local directories.

app.conf defines app metadata such as label, version, author, and visibility.

metadata/default.meta controls app and object permissions for roles.

splunk install app installs an app package from the CLI.

splunk enable app and splunk disable app control whether an app is active.

Add-ons may need installation on forwarders, indexers, or search heads depending on their function.

A search head deployer distributes apps to search head cluster members.

The cluster master coordinates peer nodes; peer nodes store and replicate buckets; search heads search the peer set.

Replication factor is the number of copies of each bucket; search factor is the number of searchable copies.

Search factor must be less than or equal to replication factor.

server.conf [clustering] mode can be master, peer, or searchhead, and pass4SymmKey must match across cluster nodes.

splunk show cluster-status displays peer and bucket replication status.

splunk apply cluster-bundle pushes the cluster bundle from the master to peers.

Maintenance mode on a peer prevents unnecessary bucket fixup during planned downtime.

Multisite clustering uses site_replication_factor and site_search_factor to control copies per site.