Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Splunk
Exam Format
Registration
Validity
Skills this practice test covers
- Compare Splunk Cloud with Splunk Enterprise, and Self-Service Cloud with Managed Cloud.
- Configure a forwarder for Splunk Cloud and manage forwarders with a Deployment Server.
- Create monitor, TCP, UDP, scripted and HTTP Event Collector inputs.
- Fix event line breaking and timestamp extraction, then check the result in Data Preview.
- Mask or filter raw data with SEDCMD and with transformations in props.conf and transforms.conf.
- Map LDAP, Active Directory or SAML sign-in to Splunk roles and their capabilities.
Explore related topics
SPLK-1005 exam content
13 domains · 39 topics · 149 of 156 questions sorted by domain
Splunk Cloud Overview5%7 questions
This domain sets out what the Splunk Cloud administrator controls. Candidates describe the cloud topology and the administrator's tasks, and list how Splunk Cloud differs from Splunk Enterprise and how Self-Service Cloud differs from Managed Cloud.
Skills tested
- Describe the components of the Splunk Cloud topology and what each one does.
- List the tasks that the Splunk Cloud administrator manages.
- Explain the main differences between Splunk Cloud and Splunk Enterprise.
Questions by topic
- List differences between Self-Service Cloud and Managed Cloud3
- List the primary differences between Splunk Cloud and Splunk Enterprise3
- Describe tasks managed by the Splunk cloud administrator1
Index Management5%12 questions
Indexes are where Splunk stores events. Candidates define and create indexes in Splunk Cloud, delete data from an index, and monitor indexing activity.
Skills tested
- Create an index in Splunk Cloud and choose its settings, such as data retention.
- Explain the limits of deleting data from an index.
- Monitor indexing activity and spot indexing problems.
Questions by topic
- Create indexes in cloud5
- Delete data from an index3
- Monitor indexing activities3
- Define a Splunk index1
User Authentication and Authorization5%6 questions
This domain decides who can sign in and what each user may do. Candidates administer user roles and link sign-in to LDAP, Active Directory or SAML.
Skills tested
- Create custom roles and give them capabilities and index access.
- Integrate Splunk Cloud with LDAP, Active Directory or SAML for sign-in.
Questions by topic
- Administer Splunk user roles3
- Integrate Splunk with LDAP, Active Directory, or SAML3
Splunk Configuration Files5%10 questions
Splunk keeps its settings in .conf files. Candidates find the main files and directories, work out which copy of a setting wins, and tell index-time processing from search-time processing.
Skills tested
- Find configuration files in the default and local directories of an app.
- Work out which setting wins under configuration file precedence.
- Sort a setting into index-time or search-time processing.
Questions by topic
- Review Splunk configuration files and directories4
- Review configuration file precedence3
- Review index and search time processes3
Getting Data in Cloud15%19 questions
One of the two heaviest domains is about forwarders, which collect data and send it to Splunk Cloud. Candidates compare forwarder types, configure and test a forwarder connection, and set optional forwarder settings.
Skills tested
- Compare the Universal Forwarder and the Heavy Forwarder, and pick one for a task.
- Configure a forwarder to send data to Splunk Cloud, then test the connection.
- Set optional forwarder settings such as load balancing, compression and indexer acknowledgement.
Questions by topic
- List Splunk forwarder types8
- Configure a forwarder to Splunk Cloud4
- Test the forwarder connection3
- Describe optional forwarder settings4
Forwarder Management5%9 questions
Forwarder management controls many forwarders from one place. Candidates describe the Deployment Server, turn forwarders into deployment clients and manage them with deployment apps.
Skills tested
- Configure a forwarder as a deployment client in deploymentclient.conf.
- Create deployment apps and target them at chosen forwarders.
Questions by topic
- Managing forwarders using deployment apps3
- Configure forwarders to be deployment clients3
- Explain the use of forwarder management3
Monitor Inputs15%17 questions
The other heaviest domain covers files and directories that Splunk watches for new data. Candidates describe the input process, create monitor inputs and use their optional settings.
Skills tested
- Create file and directory monitor inputs with a monitor stanza in inputs.conf.
- Set the host, source type and index that a monitor input assigns.
- Use optional monitor settings, such as ignoring older files and CRC checking.
Questions by topic
- Use optional settings for monitor inputs11
- Describe the Splunk process for inputting data3
- Create file and directory monitor inputs3
Network and Other Inputs10%20 questions
Not all data comes from files. Candidates create TCP and UDP inputs and scripted inputs, identify Windows input types, and send events through the HTTP Event Collector.
Skills tested
- Create TCP and UDP network inputs and set their optional settings.
- Write a basic scripted input that runs on a schedule.
- Pick a Windows input type, such as event log or Active Directory monitoring.
- Send events to Splunk with the HTTP Event Collector and HEC tokens.
Questions by topic
- Use the HTTP Event Collector (HEC) to get data into Splunk6
- Create a basic scripted input4
- Identify Windows input types and uses7
- Create network (TCP and UDP) inputs3
Fine-tuning Inputs5%9 questions
This domain covers what happens to data during the input phase. Candidates describe the default processing there and change input options, such as the source type and the character set encoding.
Skills tested
- Describe the metadata, such as host, source and source type, that the input phase assigns.
- Override the default source type and set the character set encoding of an input.
Questions by topic
- Configure input phase options, such as sourcetype fine-tuning and character set encoding4
- Describe the default processing that occurs during the input phase5
Parsing Phase and Data Preview10%14 questions
Parsing turns the incoming data stream into separate events, each with its own timestamp. Candidates tune event line breaking, control how timestamps and time zones are found, and check the result in Data Preview.
Skills tested
- Set event breaking with LINE_BREAKER or BREAK_ONLY_BEFORE.
- Control timestamp extraction with settings such as MAX_TIMESTAMP_LOOKAHEAD, and assign time zones.
- Use Data Preview to check event boundaries and timestamps before the data is indexed.
Questions by topic
- Optimize and configure event line breaking3
- Explain how timestamps and time zones are extracted or assigned to events5
- Use Data Preview to validate event creation during the parsing phase3
- Describe the default processing that occurs during parsing3
Manipulating Raw Data10%14 questions
This domain changes events before Splunk stores them. Candidates define transformations in props.conf and transforms.conf, and use SEDCMD to rewrite raw text, for example to mask private values.
Skills tested
- Call a transforms.conf stanza from props.conf to change or route events.
- Mask sensitive values in raw data with SEDCMD.
- Filter out unwanted events with a transformation.
Questions by topic
- Use transformations with props.conf and transforms.conf to modify raw data5
- Use SEDCMD to modify raw data4
- Explain how data transformations are defined and invoked5
Installing and Managing Apps5%6 questions
Apps add inputs, dashboards and settings to Splunk Cloud. Candidates follow the install process, describe private apps and their vetting, and manage apps after they are installed.
Skills tested
- Install an app in Splunk Cloud by the supported process.
- Explain how private apps are vetted before they can be installed.
- Update and remove apps, and set their permissions.
Questions by topic
- Describe private apps3
- Describe how apps are managed3
Working with Splunk Cloud Support5%6 questions
Some problems need Splunk Cloud Support. Candidates isolate a problem first, gather the details that support needs, and then follow the support process.
Skills tested
- Isolate a problem with internal logs and searches before opening a case.
- Gather the troubleshooting details that Splunk Cloud Support needs.
Questions by topic
- Isolate problems before contacting Splunk Cloud Support3
- Define the process for working with Splunk Cloud Support3
Requirements
- Required: Splunk Core Certified Power User.
- Recommended: experience running a Splunk Cloud Platform deployment.
- Recommended: familiarity with data inputs, forwarder management and Splunk configuration files.
About the SPLK-1005 exam
SPLK-1005 tests the daily administration of Splunk Cloud Platform: getting data in, managing indexes, users and apps, and isolating problems before they go to Splunk Cloud Support. Most of its blueprint weight sits on forwarders, monitor and network inputs, parsing and changes to raw data. Candidates must already hold Splunk Core Certified Power User. Passing earns Splunk Cloud Certified Admin, which Splunk places at the Professional level.
The PlanetCert practice test puts the most questions on getting data in: forwarders, monitor inputs, network and scripted inputs, Windows inputs and the HTTP Event Collector. The explanations show where each setting takes effect, for example why line breaking and timestamp rules in props.conf act during the parsing phase. Flashcard Mode helps with setting names that are easy to mix up, such as LINE_BREAKER and BREAK_ONLY_BEFORE. Brainy AI Assistant can explain configuration file precedence, or how a transforms.conf stanza changes raw data.
How to earn the certification
- Earns
- Splunk Cloud Certified AdminProfessional
Splunk certifications follow a three-year cycle. Retaking the exam in the final year of the cycle, or completing qualifying continuing education courses, renews it.
- Before
- SPLK-1002 Splunk Core Certified Power User
Required before SPLK-1005. Splunk asks for no prerequisite course.
- SPLK-1001 Splunk Core Certified User
An optional first exam on searching and reporting. Splunk lists Power User as the step after it.
- SPLK-1002 Splunk Core Certified Power User
- After
- SPLK-3002 Splunk IT Service Intelligence Certified Admin
Administration of Splunk IT Service Intelligence. Splunk's study guide lists it among the next steps after Cloud Admin.
- SPLK-3002 Splunk IT Service Intelligence Certified Admin
How to prepare for SPLK-1005
- 1
Set up a cloud stack and a forwarder
Practise on a Splunk Cloud Platform deployment with an admin role, and install a Universal Forwarder on a test machine to send data to it.
- 2
Follow one log from file to event
Pick a real log file. Send it through a monitor input, set its source type, then fix line breaking and timestamps in props.conf and check them in Data Preview.
- 3
Put the input domains first
Getting Data in Cloud and Monitor Inputs carry the most weight, with network inputs, parsing and raw data close behind. Create TCP, UDP, scripted, Windows and HEC inputs at least once each.
- 4
Map the cloud admin's tasks
List the tasks the Splunk Cloud administrator manages, how they differ from Splunk Enterprise administration, and what to check before contacting Splunk Cloud Support.
- 5
Rehearse under exam timing
Take the SPLK-1005 practice test in Study Mode one domain at a time, then a full run in Timed Mode. Ask Brainy AI Assistant to explain any missed props.conf or transforms.conf answer.
Start a timed SPLK-1005run
Splunk's Cloud Admin learning path offers Splunk Cloud Administration for new administrators and Transitioning to Splunk Cloud for experienced Splunk Enterprise administrators.
Who SPLK-1005 is for
- New Splunk administrators whose organization runs Splunk Cloud Platform.
- Experienced Splunk Enterprise administrators who are migrating to Splunk Cloud.
- IT and cloud operations staff who manage data inputs and forwarders for Splunk Cloud.
- Holders of Splunk Core Certified Power User who want an administrator certification.
Typical job titles: Splunk Cloud administrator · Splunk administrator · Platform administrator · Cloud operations engineer
SPLK-1005 glossary
18 terms from the exam objectives and the vendor's official material, each defined in a sentence.
- Configuration file precedence
- The rules that decide which copy of a setting wins when several .conf files set it.
- Data Preview
- A Splunk tool that shows how sample data will be split into events and timestamped before it is indexed.
- Deployment client
- A forwarder that checks in with a Deployment Server to receive its apps.
- Deployment Server
- A Splunk instance that sends configuration, packed as deployment apps, to many forwarders at once.
- deploymentclient.conf
- The configuration file that tells a forwarder which Deployment Server to contact.
- Heavy Forwarder
- A full Splunk instance that forwards data and can parse or filter it before sending.
- HTTP Event Collector (HEC)
- A token-based endpoint that lets applications send events to Splunk over HTTP or HTTPS.
- Indexer acknowledgement
- A forwarder setting that makes the indexer confirm each block of data, so lost data can be sent again.
- inputs.conf
- The configuration file that defines data inputs, such as monitor, network and scripted inputs.
- LINE_BREAKER
- A props.conf setting whose regular expression marks where one event ends and the next one starts.
- MAX_TIMESTAMP_LOOKAHEAD
- A props.conf setting that limits how far into an event Splunk looks for a timestamp.
- props.conf
- The configuration file that controls how data of a source type is parsed, including line breaking and timestamps.
- Scripted input
- An input that runs a script on a schedule and indexes what the script prints.
- SEDCMD
- A props.conf setting that rewrites raw event text with a find-and-replace expression, often to mask data.
- Sourcetype
- A label for the format of incoming data. Splunk uses it to decide how to parse the data.
- Splunk index
- A store where Splunk keeps processed events. Each index has its own access settings and retention.
- transforms.conf
- The configuration file that defines transformations, such as masking or filtering, which props.conf calls.
- Universal Forwarder
- A lightweight Splunk agent that collects data on a machine and sends it on for indexing.