Splunk Enterprise Certified Admin

Understanding deployment topologies, distributed architectures, and administrator responsibilities.

Configuring license pools, license masters, handling warnings, and monitoring daily ingestion volume.

Deep-dive into .conf file structures, stanza inheritance, and directory configuration precedence.

Creating and managing indexes, bucket storage lifecycles (Hot, Warm, Cold, Frozen), and retention policies.

Configuring local users, custom roles, capability mappings, and search-head resource quotas.

Integrating enterprise directory services: LDAP mappings, Active Directory, and SAML single sign-on (SSO).

Overview of input methods, sourcetype definitions, and determining appropriate input options.

Setting up search heads, search peers, knowledge bundle replication, and distributed search groups.

Managing file uploads, previewing data, testing event breakups, and saving modular configurations.

Installing Universal Forwarders (UF) and Heavy Forwarders (HF), load balancing, and outputs.conf.

Centralized configuration deployment using the Splunk Deployment Server, server classes, and apps.

Configuring file and directory monitors, log file rotation handling, and whitelist/blacklist rules.

Ingesting real-time UDP/TCP syslog feeds and writing scripted inputs to collect custom system metrics.

Collecting data via HTTP Event Collector (HEC), token authentication, and REST endpoint polling.

Setting default host assignments, sourcetype overrides, time stamps, and queue size optimizations.

Understanding the internal pipeline: input ➔ parsing (props.conf) ➔ indexing (transforms.conf).

Filtering events before indexing, anonymizing PII data (regex masks), and routing logs to specific indexes.