thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Splunk · Cybersecurity · Professional

Splunk Enterprise Certified Admin exam guide

Exam SPLK-1003

Splunk Enterprise Certified Admin validates the ability to manage Splunk Enterprise: licenses, indexers and search heads, configuration files, users, data inputs and forwarder management. It is the key credential for Splunk platform administrators.

Questions56
Time limit60 minutes
Passing scoreSee official page
Exam fee$130 USD
Valid for3 years
DeliveryPearson VUE test center or online proctored

Format: Multiple choice. Fee note: Per attempt.

Who it's for

Engineers who install, configure and maintain Splunk Enterprise deployments.

What the exam covers

The vendor does not publish a domain breakdown for this exam. Check the official exam page for the current objectives.

Eligibility & prerequisites

Required: Splunk Core Certified Power User.

Recommended: Splunk administration training and hands-on platform work.

Keeping it active

Splunk certifications are valid 3 years; recertify by passing the current exam or a higher-level exam in the same track.

Skills & careers

Skills it validates

  • License management
  • Indexer and search head configuration
  • Configuration file precedence
  • Forwarder management and inputs
  • User roles and authentication
  • Monitoring and troubleshooting Splunk

Job roles

Splunk AdministratorSIEM EngineerSecurity EngineerObservability EngineerSystems Administrator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Install Splunk Enterprise and a universal forwarder.
  2. Week 2: Inputs, indexes and props/transforms.
  3. Week 3: Users, roles, licensing and configuration precedence.
  4. Week 4: Distributed deployments and practice tests.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Memorize configuration file precedence.
  • Know which .conf files control inputs, parsing and indexing.
  • Understand forwarder management with deployment server.
  • Expect licensing questions.

Key terms for this exam

All 16 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

How much is SPLK-1003?

$130 USD.

Prerequisite?

Splunk Core Certified Power User.

How many questions?

56 in 60 minutes.

How long is it valid?

3 years.

What next?

Splunk Enterprise Certified Architect.

Official page: www.splunk.com. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.