Splunk Splunk Admin Practice Test

Splunk Admin practice test: what's covered

• Splunk Core Certified Admin
• v9

Free Splunk Admin sample questions

1. A new admin needs to deploy a forwarder on 500 web servers. The forwarders should send raw web logs to indexers with the LIGHTEST footprint and minimal CPU. Which forwarder type is BEST?

   • A. Heavy Forwarder — it can parse before sending and offload indexers
   • B. Universal Forwarder — lightweight, no parsing, just streams to indexers
   • C. Light Forwarder — deprecated since Splunk 6.0 but still supported
   • D. Search Head Forwarder — purpose-built for distributed search
   Show answer

   Correct: B. Universal Forwarder (UF) is a stripped-down splunkd that streams unparsed data to indexers — ~50MB RAM, almost no CPU. Heavy Forwarder (HF) is a full Splunk Enterprise install used when you need to parse, route, filter, or mask BEFORE indexing (e.g., for syslog cooked routing, or sending to multiple destinations with different filters). Light Forwarder is deprecated. "Search Head Forwarder" is not a real component.

2. Which TWO scenarios REQUIRE a Heavy Forwarder instead of a Universal Forwarder? (Choose 2)

   • A. Sending raw syslog from 1000 Linux hosts to indexers
   • B. Parsing data and routing different sourcetypes to different indexer groups
   • C. Indexing on the forwarder itself (e.g., a local search peer at the edge)
   • D. Reducing endpoint memory footprint to a minimum
   • E. Forwarding with no transformations and no filtering
   Show answer

   Correct: B and C. UF cannot parse events (no props/transforms acting on _raw before indexing), cannot index locally, and cannot conditionally route by sourcetype. HF is full Splunk Enterprise with the indexer disabled (or enabled, for an edge indexer). Choosing HF for low memory is backwards — UF is the low-footprint choice.

3. In a clustered Splunk deployment, which component is RESPONSIBLE for distributing apps and configurations to clustered indexers (peer nodes)?

   • A. Deployment Server
   • B. Cluster Master (Manager Node)
   • C. License Master
   • D. Monitoring Console
   Show answer

   Correct: B. Apps in $SPLUNK_HOME/etc/manager-apps on the Manager Node are pushed to peers via the "splunk apply cluster-bundle" command. Deployment Server (DS) manages CONFIG for forwarders and NON-clustered components — never push peer-node configs from DS. License Master tracks license usage. MC is a monitoring overlay only.

4. A customer asks: "Which Splunk component should manage the configuration of 5000 Universal Forwarders deployed across the enterprise?"

   • A. Cluster Master
   • B. Deployment Server
   • C. License Master
   • D. Search Head Cluster Captain
   Show answer

   Correct: B. Deployment Server (DS) groups forwarders by serverClass and pushes apps to them via the deploymentclient.conf on each UF. Cluster Master is for indexer peer nodes only. License Master is licensing only. Captain handles SHC artifact replication, not forwarder configs.

5. Examine this server.conf stanza on a Splunk instance: <pre>[general] serverName = idx-prod-03 [clustering] mode = slave master_uri = https://cm-prod:8089 pass4SymmKey = ******** [license] active_group = Forwarder</pre> What ROLE is this Splunk instance playing?

   • A. Cluster Master managing peer nodes
   • B. Indexer peer node (Cluster Slave/Peer) in an indexer cluster
   • C. Universal Forwarder
   • D. Search Head member
   Show answer

   Correct: B. mode = slave + master_uri = clustering peer node (a.k.a. indexer peer). Cluster Master would be mode = master. UF does not have [clustering] master_uri (UFs do not join the indexer cluster). SHC peer would be in [shclustering], not [clustering].

Last updated: 2026-10-19

Splunk Admin practice test FAQ

Related practice tests

• Splunk SPLK-1002 practice test
• Splunk SPLK-1001 practice test
• Splunk Splunk ES Admin practice test
• Splunk SOAR-DEV practice test