I85PREP
⌘ K
Splunk Enterprise Certified Admin study materials
Splunk Enterprise Certified Admin study resources

Splunk Enterprise Certified Admin: Splunk Deployment and Architecture

Splunk Enterprise Certified Admin · Work through your exam, one topic at a time.

All guide sections

Splunk Deployment and Architecture

Core roles

Splunk Enterprise separates collection, indexing, search, and management. Universal forwarders (UFs) collect and send data but cannot search or do heavy parsing; heavy forwarders parse and route; indexers build and store buckets; search heads run searches and hold knowledge objects; the license manager tracks daily volume; the cluster manager coordinates indexer replication; the SHC deployer pushes apps to search head cluster members; the deployment server pushes apps to forwarders.

Ports and placement

Know the defaults: 8000 (Splunk Web), 8089 (management/REST), 9997 (splunktcp receiving), 8088 (HTTP Event Collector), 9887 (indexer replication). A common design places forwarders in a DMZ and indexers inside the protected network. Small deployments can collapse roles onto one instance; clustered deployments separate them.

Traps

  • A universal forwarder has no web UI and cannot run searches, and it does not consume indexing license.
  • Parsing usually happens on the indexer (or heavy forwarder), so props/transforms for UF-collected data belong on the parsing node, not the UF.
  • The cluster manager and license manager are management roles; they do not index data.
  • Search head cluster members are configured by a deployer, not by the deployment server.

Rule of thumb

Ask which process reads this file: inputs.conf goes on the collecting node, props.conf/transforms.conf on the parsing node, indexes.conf on the indexer, distsearch.conf on the search head, serverclass.conf on the deployment server.