SPLK-1005 Exam Format | Course Contents | Outline | Syllabus | Objectives

SPLK-1005 Exam Syllabus & Study Guide

Before you start practicing with our exam simulator, it is essential to understand the official SPLK-1005 exam objectives. This course outline serves as your roadmap.

The information below reflects the 2026 syllabus defined by Splunk.

Below are complete topics detail with latest syllabus and course outline, that will help you good knowledge about exam objectives and topics that you have to prepare. These contents are covered in questions and answers pool of exam.

Splunk Cloud overview - Describe Splunk Cloud topology and architecture - Tasks and responsibilities managed by Splunk Cloud administrators - Primary differences between Splunk Cloud and Splunk Enterprise - Differences between Self-Service Cloud and Managed Cloud (or similar deployment models) Splunk index management - Define what a Splunk index is and its purpose - Create and manage indexes in Splunk Cloud - Delete or remove data from an index - Monitor indexing activities, volume, and performance Users, roles, and authentication - Administer and manage Splunk user accounts and roles - Assign and customize roles with appropriate capabilities - Integrate Splunk with external authentication systems (LDAP, Active Directory, SAML) - Manage authentication methods and user authorization Splunk configuration files - Review Splunk configuration files and directories (e.g., *.conf files) - Understand and apply configuration file precedence - Review index-time vs. search-time processes - Best practices for editing and managing configuration files Universal forwarder - List different Splunk forwarder types (including Universal Forwarder) - Describe the role and capabilities of forwarders - Configure a Universal Forwarder to send data to Splunk Cloud - Test forwarder connections and connectivity - Describe optional forwarder settings and configurations Forwarder management - Describe the Splunk Deployment Server and its components - Explain the use of forwarder management - Configure forwarders as deployment clients - Manage forwarders using deployment apps and server classes - Deploy and update configurations via deployment apps Data inputs in detail - Describe the Splunk process for ingesting data (input phase) - Create and configure file and directory monitor inputs - Use optional settings for monitor inputs (e.g., whitelists, blacklists, recursion) - Create network inputs (TCP and UDP) - Create basic scripted inputs - Identify and use Windows-specific input types - Use the HTTP Event Collector (HEC) for data ingestion - Describe optional settings for various input types Event parsing with data preview - Describe default processing during the parsing phase - Optimize and configure event line breaking (BREAK_ONLY_BEFORE, etc.) - Explain timestamp and time zone extraction or assignment - Use Data Preview to validate and troubleshoot event creation - Fine-tune sourcetypes and parsing configurations Manipulating raw data - Explain how data transformations are defined and invoked - Use props.conf and transforms.conf to modify raw data - Apply SEDCMD for regex-based modifications to raw data - Configure anonymization, masking, or other data transformations Installing apps - Review the process for installing and managing apps in Splunk Cloud - Describe private apps and their use cases - Manage app installation, updates, and permissions - Understand app deployment considerations in Cloud environments Problem isolation and Splunk Cloud support - Isolate problems before escalating to Splunk Cloud Support - Define the official process for working with Splunk Cloud Support - Use monitoring and diagnostic tools for troubleshooting - Identify common issues in indexing, forwarding, search, and inputs