Splunk Enterprise Certified Admin study plan
Splunk Enterprise Certified Admin · Give each week a clear focus.
8 weeks · About 6 hours per week
Splunk Deployment and Architecture
Diagram a three-tier Splunk deployment (universal/heavy forwarder → indexer → search head) and label where parsing, indexing, and searching occur
Distinguish which inputs and parsing functions require a heavy forwarder versus a universal forwarder, using at least four concrete examples
Install a single-instance Splunk Enterprise lab and verify splunkd, web, and licensing services start and remain healthy
Locate and describe the role of the main directories: $SPLUNK_HOME/etc/system, /etc/apps, /var/lib/splunk, and /var/log/splunk
Your checkpoint
A one-page annotated architecture diagram plus a running lab instance whose services you can start, stop, and verify on demand
Getting Data In
Configure file and directory monitoring inputs in inputs.conf, including whitelist/blacklist patterns, and confirm the effective stanza with splunk btool inputs list --debug
Set sourcetype-level parsing rules in props.conf (TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD, LINE_BREAKER, TRUNCATE) and validate that events break and timestamp correctly
Configure network inputs (TCP/UDP syslog) and a scripted or Windows input, then compare how each appears in _internal and in search results
Create a custom sourcetype and confirm it survives a splunkd restart so settings are persisted in the correct config layer
Your checkpoint
A written inventory of five data inputs listing the input stanza, sourcetype, resulting index, and the search used to verify each one
Getting Data In & Index Management
Deploy a universal forwarder pointed at the lab indexer with outputs.conf, and prove delivery by searching the forwarder's internal logs on the indexer
Create a custom index in indexes.conf and set retention using frozenTimePeriodInSecs and maxTotalDataSizeMB, then verify the values with the REST endpoint
Configure an index-level or volume-based storage path and explain the difference between hot/warm and cold bucket locations
Troubleshoot at least two ingestion failures end to end (wrong sourcetype, wrong index permissions) and record the fix
Your checkpoint
A configured custom index with documented retention settings plus forwarder-delivered events visible on the indexer and a troubleshooting log of two resolved ingestion issues
User, Role, and Authentication Management
Create three roles with different index access and capabilities, then create users mapped to them and confirm inheritance behaves as expected
Configure an external authentication source (LDAP or SAML) in a lab and map an external group to a Splunk role
Tune the authentication policy - password complexity, lockout, and session timeout - in authentication.conf
Audit the current user/role state using REST calls such as /services/authentication/users and /services/authorization/roles
Your checkpoint
A role-and-user matrix exported from the REST API showing each role's indexes and capabilities, with a note on which settings came from LDAP versus local config
User, Role, and Authentication Management & Configuration Files
Rank the configuration precedence order (system default → app default → app local → system local) and prove it with a controlled btool experiment
Build a custom app under $SPLUNK_HOME/etc/apps with default/ and local/ directories and move scattered settings into it
Apply a role-based search filter that restricts results for one test role and verify the restriction with that user's login
Use btool to resolve the winning value for three settings that exist in more than one file, and document the source file for each
Your checkpoint
A packaged custom app containing at least three configuration files, plus btool output naming the effective source of three conflicting settings
Distributed Search and Forwarder Management
Add a remote indexer as a search peer on a search head and verify the connection with the CLI and the distributed search endpoints
Configure a deployment server with serverclass.conf and push an app to a forwarder client, confirming the phone-home in the client's _internal logs
Configure forwarder load balancing and failover with an outputs.conf server group and explain when to use automatic versus manual load balancing
Compare deployment server, indexer cluster bundle push, and manual app deployment for distributing configuration to each tier
Your checkpoint
A working deployment server with one serverclass and one enrolled client, evidenced by the phone-home log excerpt and the deployed app present on the client
Indexer Clustering & Monitoring Splunk
Bring up an indexer cluster with a manager node and peers using a replication factor and search factor, then read cluster health from the CLI
Explain what happens to buckets when replication factor exceeds search factor, and identify the fix for an under-replicated bucket in cluster status output
Configure the Monitoring Console and run a health check across the deployment, interpreting the license, indexing, and search-related warnings
Set up an alert or scheduled search that watches an operational metric (such as indexing delay or skipped searches) and routes a result
Your checkpoint
A saved cluster status output showing peer and bucket states alongside a Monitoring Console health-check summary with each warning explained in one line
License Management & Splunk Apps and Add-ons
Read current license usage and pool allocation from the licensing endpoints and configure a warning threshold that triggers before the quota is reached
Explain how a license violation affects indexing behavior and how a rolling window of license usage is measured
Install an app and an add-on, then set app-level permissions and verify which roles can see each one
Run a timed self-assessment covering all ten domains and convert weak areas into a ranked remediation list
Your checkpoint
A license usage screenshot plus a domain-by-domain scorecard from the timed assessment with a ranked list of the three weakest domains and the specific config topics to revisit
Milestones
Week 2: You can take a raw log file from disk to searchable, correctly timestamped events without referring to notes, and explain each config file involved
Week 4: You can create a role, restrict its index access, attach a user authenticated against an external source, and prove the restriction with that user's own search
Week 6: You can explain and demonstrate the full path of an app from deployment server to a forwarder, and justify when a cluster bundle push would be the better mechanism
Week 8: You score at least 80 percent overall on the timed self-assessment with no single domain below 70 percent, and you hold a written remediation list for anything lower