Splunk Enterprise Certified Admin study guide
Splunk Enterprise Certified Admin · Work through your exam, one topic at a time.
The Splunk Enterprise Certified Admin is a Professional-level credential from Splunk for people responsible for the day-to-day administration and health of a Splunk Enterprise environment. Splunk positions it for platform administrators, for career builders moving beyond searches and dashboards, and for Enterprise Security administrators who want a stepping stone toward administering a Splunk Enterprise Security deployment. The Splunk Enterprise Certified Admin study guide has 10 sections and about 2,928 words.
01Splunk Deployment and Architecture
Splunk Enterprise separates collection, indexing, search, and management . Universal forwarders (UFs) collect and send data but cannot search or do heavy parsing; heavy forwarders parse and route; indexers build and store buckets; search heads run searches and hold knowledge objects; the license manager tracks daily volume; the cluster manager coordinates indexer replication; the SHC deployer pushes apps to search head cluster members; the deployment server pushes apps to forwarders.
281 words, about 1 min02License Management
Licenses are measured in indexing volume per day (GB/day) and organized into a stack : keys grouped into pools , governed by a license manager (historically called the license master), with peers/slaves (indexers) reporting to it. Forwarders need no license.
317 words, about 2 min03Configuration Files
Splunk merges configuration stanza by stanza and key by key , never file by file. From lowest to highest precedence: etc/system/default → etc/apps/ /default → etc/system/local → etc/apps/ /local → etc/users/ /local (user context only).
299 words, about 1 min04User, Role, and Authentication Management
A user is granted one or more roles ; each role bundles capabilities such as search , schedule search , edit user , delete by keyword , or admin all objects . Effective permission is the union of all assigned and inherited roles - there are no deny rules, so adding a role can only broaden access.
303 words, about 2 min05Index Management
Every index defines homePath (hot/warm), coldPath , and thawedPath in indexes.conf . Buckets progress hot → warm → cold → frozen .
271 words, about 1 min06Getting Data In
Pick based on control and scale: universal forwarder monitoring (best for most file and Windows event collection); network inputs such as [splunktcp://9997] for forwarded data; HTTP Event Collector (port 8088, token-based) for applications and scripts; [script://] for scheduled scripted input; [monitor://] for files and directories; and agentless options like syslog, SNMP, and database connectors. Input stanzas carry index , sourcetype , host , and must not be left at disabled = 1 .
276 words, about 1 min07Distributed Search and Forwarder Management
A search head fans searches out to indexers listed in distsearch.conf ( [distributedSearch] servers ), or added with splunk add search-server -auth <user :<pass https://<indexer :8089 . The search head must have the same search-time knowledge (props/transforms, lookups, field extractions) as the indexers; missing knowledge objects are the classic reason a search returns nothing in a distributed deployment.
258 words, about 1 min08Monitoring Splunk
Splunk monitors itself through internal indexes and endpoints: internal (splunkd.log, metrics.log, and other component logs), audit (user activity), introspection (resource usage from introspection generators), and telemetry . The Monitoring Console , a bundled app typically run on a search head, aggregates health checks, license usage, indexer clustering status, deployment status, and disk/CPU trends across the deployment.
291 words, about 1 min09Splunk Apps and Add-ons
An app typically has a UI and appears in the launcher; an add-on (often a technology add-on, TA) supplies inputs, field extractions, lookups, or CIM mappings and usually has no UI. Both share the same layout: default/ (vendor-owned, overwritten on upgrade), local/ (preserved), metadata/ , appserver/ , bin/ , and app.conf .
295 words, about 1 min10Indexer Clustering
An indexer cluster has one cluster manager (historically the master), several peer indexers, and search heads pointed at the cluster. Peers hold replicated buckets; the manager coordinates replication, bucket fixup, and priming.
337 words, about 2 min