Splunk is a software platform that collects, indexes, and searches machine-generated data from any source. For the SPLK-1002 exam, you need to understand how the different parts of Splunk fit together to turn messy log files into actionable insights. This foundational knowledge is the key to every other topic on the exam.
Jump to a section
A simple way to picture Splunk Overview and Core Architecture
A central city post office is a busy place.
Every day, trucks arrive from all over the city and surrounding towns, each carrying thousands of letters and parcels. These items are the data. A letter from a local bakery complaining about a broken oven is a log from a web server. A package containing a signed contract is a record of a user login. The post office’s first job is to accept everything that comes in, no matter what it looks like. It does not care if the envelope is blue or white, handwritten or typed. This is the data ingestion phase.
Once inside, the letters are dumped onto a giant conveyor belt. This belt is the processing pipeline. The letters move past a series of machines. The first machine, a bar-code reader, scans each item and adds a routing label. This is like Splunk indexing, where raw data gets a timestamp and an index assignment. Next, the letters pass a machine that checks the address for errors. If an address is missing a street number, the machine puts the letter in a special 'needs correction' bin. Splunk does this too, flagging malformed data. Finally, the letters are sorted into bags for specific neighbourhoods. The bag for 'Downtown Sector A' is a Splunk index. The postal workers then deliver those bags to local depots. In Splunk, this is like making data available for search. A manager at the bakery can later ask the post office, 'Did the letter about my broken oven arrive?' and the post office can reply, 'Here are all the letters from that week.' The post office does not read every letter, but it has a record of every transaction and can find the one you need.
Splunk is a tool designed to make sense of the massive amounts of data that computers, servers, applications, and network devices constantly produce. This data is called machine data. Every time a user logs into a system, a web server serves a page, or a firewall blocks a connection, a log entry is created. A single organisation can generate billions of these log entries per day. Before tools like Splunk existed, IT teams had to search through individual log files on individual machines, which was incredibly slow and inefficient.
Splunk solves this by providing a centralised platform where all this data can be sent, processed, and made searchable in near real-time. The core architecture consists of three main components: the Forwarder, the Indexer, and the Search Head. Understanding how these three parts interact is critical for the SPLK-1002 exam.
The first component is the Forwarder. This is a lightweight piece of software installed on a machine that generates data, such as a web server or a database server. The Forwarder’s job is simple: it watches the machine's log files and forwards any new data to the Indexer. It does minimal processing of the data itself; its main purpose is to get the raw data from the source and send it over the network. There are different types of Forwarders, including Universal Forwarders (lightest weight) and Heavy Forwarders (which can do some basic parsing before sending). For the exam, you should know that a Universal Forwarder is the most common choice because it consumes very few resources on the source machine.
The second component is the Indexer. This is the heavy lifter of the Splunk architecture. When an Indexer receives data from a Forwarder, it processes it, stores it, and makes it searchable. The processing stage is called indexing. During indexing, Splunk performs several critical tasks:
It parses the raw data into individual events. A single line in a log file is one event.
It extracts a timestamp from each event. This is crucial because Splunk uses time as the primary axis for organisation.
It creates a compressed, indexed copy of the data, stored in a directory called an index.
Once data is indexed, it is available for searching. An index is like a special folder on the Indexer’s hard drive that contains all the processed data from a particular source or type. For example, you might have one index for web server logs and another index for firewall logs. The Indexer is also responsible for managing data lifecycle, meaning it will automatically delete or archive old data based on rules you set.
The third component is the Search Head. This is the user-facing part of Splunk. You interact with the Search Head when you type queries into Splunk’s search bar. The Search Head sends your search request to the Indexers, which then retrieve the relevant events from their indexes and send them back. The Search Head then presents the results to you in an organised format, such as a table or a chart. Multiple users can connect to one Search Head, and in large deployments, there can be multiple Search Heads working together in a search head cluster.
Beyond these core components, there are other important architectural elements. A Deployment Server is used to manage the configuration of many Forwarders from a central location. A License Master enforces the volume of data you are allowed to index per day, based on the license you have purchased. For the SPLK-1002 exam, you need to be able to draw a simple diagram showing Forwarders sending data to Indexers, and Search Heads querying the Indexers. You also need to understand that this architecture is designed to be horizontally scalable, meaning you can add more Indexers or more Forwarders as your data volume grows, without needing to replace existing hardware.
Data Generation
A machine, such as a web server or a database server, produces log data. Each action, like a user login or a page request, creates a new log entry. This is the raw material that Splunk will eventually process.
Data Collection by Forwarder
A Splunk Universal Forwarder, installed on the source machine, monitors the designated log files. When a new log entry is written, the Forwarder picks it up and sends it over the network to the Indexer. The Forwarder does not alter the data at this stage.
Data Ingestion and Indexing
The Indexer receives the raw data from the Forwarder. It parses the data into individual events, extracts a timestamp from each event, and writes the processed data into a compressed index file on its storage. This process makes the data searchable.
User Search Query
A user types a search string into the Splunk web interface on the Search Head. This query might be something like 'error' or 'status=500'. The Search Head prepares the query and sends it to the appropriate Indexer(s).
Search Execution and Result Return
The Indexer receives the query from the Search Head, searches its indexes for matching events, and returns the results to the Search Head. The Search Head then formats and displays the results to the user, often in a table or chart.
Data Lifecycle Management
The Indexer automatically manages the data lifecycle based on user-configured retention policies. Old data may be deleted or moved to an archive after a set number of days. This frees up storage space on the Indexer without manual intervention.
Imagine you are the only IT support person at a medium-sized e-commerce company called 'ShopFast'. One Tuesday morning, customers start calling to complain that the website is loading very slowly on the checkout page. You need to find out what is causing the problem. Before Splunk, you would have to log in to each web server individually, look through huge text log files, and try to find a needle in a haystack. With Splunk, you have a much better approach.
Here is what you would actually do step by step:
First, you would already have Splunk Forwarders installed on every web server, database server, and network device in your environment. These Forwarders are quietly sending all their log data to a central Splunk Indexer. You set this up last month as part of your company’s infrastructure setup.
When the complaints come in at 10:00 AM, you open the Splunk web interface on your Search Head. You type a simple search into the bar: index=web_servers sourcetype=access_combined earliest=-2h. This tells Splunk to look only in the index that contains web server logs, only for the log format called 'access_combined', and only for events from the last two hours.
Splunk instantly shows you thousands of events. Each event is a single HTTP request made to your web servers. You scan the results. You notice that a large number of events have a status code of 500, which means 'Internal Server Error'. You refine your search to look only for those events: index=web_servers status=500.
Now you see a pattern. Most of the 500 errors happen on requests that go to the /checkout endpoint. You suspect the database server is the bottleneck. You check the database server logs by searching index=db_servers sourcetype=postgresql. You see entries that say 'connection timeout' and 'too many connections'.
You now have evidence. You know the web servers are calling the database too aggressively on the checkout page, and the database is running out of connection slots. You can now alert your senior engineer, or you can look up the specific configuration file on the web server to adjust the connection pool settings.
Without Splunk, this investigation would have taken hours. With Splunk, you found the root cause in under five minutes. This ability to correlate data from different sources and search across all your infrastructure from one place is the primary value Splunk provides. For the exam, remember that the real-world workflow is always: Forwarder collects -> Indexer stores -> Search Head queries.
The SPLK-1002 exam tests your understanding of Splunk's core architecture thoroughly, because every other concept builds on this foundation. The exam expects you to know the three main components (Forwarder, Indexer, Search Head) and their specific roles. The most common question type is a multiple-choice question asking 'Which Splunk component is responsible for collecting data from a remote source?' The correct answer is Forwarder. They will also ask 'Which component stores the indexed data?' That is the Indexer.
Another frequent question tests the concept of 'indexing'. The exam might ask: 'What does the Indexer do during the indexing process?' The correct answer involves parsing the data into events, extracting timestamps, and creating an index. They will set traps by offering options like 'The Indexer establishes a connection to the source device' (that is the Forwarder's job) or 'The Indexer displays search results' (that is the Search Head).
You need to memorise the following key concepts exactly as they appear in Splunk documentation:
The Universal Forwarder is the most common type of Forwarder. It is lightweight and does minimal processing.
A Heavy Forwarder can parse data before sending it to the Indexer.
An index is a repository for data on the Indexer.
Searching across multiple Indexers is called 'distributed search'.
The Search Head acts as the 'quarterback' that orchestrates search requests to multiple Indexers and then merges the results.
Traps to watch for:
The exam will try to confuse you with terminology. For example, 'parsing' and 'indexing' are sometimes used interchangeably in casual conversation, but in Splunk, parsing is a part of the indexing process, not a separate component. Be precise.
They may present a scenario where data is not being indexed. The correct troubleshooting step is to check the Forwarder configuration, not the Search Head.
They might list 'License Master' or 'Deployment Server' as answer choices. Know that these are important supporting components, but they are not one of the three core components (Forwarder, Indexer, Search Head) that the exam focuses on.
Another trap is confusing the role of the Indexer with the role of the Search Head. The Indexer stores and retrieves data; the Search Head queries the Indexer and displays results. The Indexer does not 'search' on its own; it only responds to queries from the Search Head.
The exam likes to ask about 'data flow'. You must be able to order the steps correctly: 1) Forwarder collects data, 2) Forwarder sends data to Indexer, 3) Indexer indexes and stores data, 4) Search Head sends query to Indexer, 5) Indexer returns results to Search Head.
Practise drawing the architecture from memory. You should be able to label a diagram with arrows showing data moving from Forwarder to Indexer to Search Head. That visual understanding will help you avoid the most common mistakes.
The three core components of the Splunk architecture are the Forwarder, Indexer, and Search Head.
A Universal Forwarder is a lightweight agent that collects and forwards data without parsing it.
The Indexer processes raw data into events, extracts timestamps, and stores the results in an index.
The Search Head acts as the user-facing interface that queries Indexers and displays search results.
Data flows from the Forwarder to the Indexer, and queries flow from the Search Head to the Indexer.
Splunk's architecture is horizontally scalable, allowing you to add more Indexers to handle more data.
An index is a dedicated storage location on an Indexer that contains all processed data from a specific source.
These come up on the exam all the time. Here's how to tell them apart.
Forwarder
Lightweight agent installed on data source
Minimal processing of data
Sends data over network
Indexer
Central server that receives and processes data
Parses, timestamps, and stores data
Manages data on local storage
Indexer
Stores and retrieves indexed data
Responds to search queries
Manages data lifecycle
Search Head
Provides user-facing search interface
Sends queries to Indexers and merges results
Displays results in dashboards and reports
Universal Forwarder
Sends raw unparsed data
Very low resource usage
Most common type
Heavy Forwarder
Can parse and filter data before sending
Uses more CPU and memory
Used when local processing is needed
Index
Compressed and organised for fast search
Contains timestamps and parsed events
Managed by Indexer lifecycle rules
Raw Data File
Original text log file on source machine
Not searchable by Splunk directly
Large and unorganised
Mistake
Splunk stores raw data in its original form, like a text file on a hard drive.
Correct
Splunk stores data in a proprietary compressed and indexed format, optimised for fast searching. The original raw text is not kept as a standalone file.
Beginners think of Splunk as a simple log viewer. They do not understand the indexing process that transforms the data into a searchable format.
Mistake
The Search Head is the most powerful component because it is what the user sees.
Correct
The Indexer does the heavy work of storing and retrieving data. The Search Head simply orchestrates queries and displays results. In a large deployment, you need many Indexers but usually far fewer Search Heads.
Novice users associate importance with the user interface they interact with, overlooking the backend processing power of the Indexer.
Mistake
You need to install Splunk on every machine to collect its logs.
Correct
You only install a lightweight Forwarder on each machine. The Forwarder sends data to a central Indexer over the network. You do not install the full Splunk application on every machine.
It seems logical that a big software tool would need to be fully installed everywhere. Many beginners do not realise the architecture separates data collection from data processing.
Mistake
Once data is indexed, you cannot delete it or change its retention period.
Correct
Indexes have configurable retention policies. You can set data to be deleted after a certain number of days, or archived to cheaper storage. This is managed through index settings.
People assume that once something is in a database it is permanent. In Splunk, you control the lifecycle of your data to manage storage costs.
Mistake
The Forwarder and the Indexer must be on the same physical or virtual machine.
Correct
They are typically on different machines. The Forwarder runs on the machine generating data, and sends it over a network to the Indexer, which is often on a separate dedicated server.
Beginners think of all Splunk components as a single monolithic application. They do not appreciate the distributed, client-server nature of the architecture.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A Universal Forwarder is very lightweight and only forwards raw data. A Heavy Forwarder can parse and filter data before forwarding it, but it consumes more system resources.
Yes, you can have many Indexers. This is called a distributed environment. You would use a Search Head to send queries to all Indexers simultaneously to search across all your data.
The Forwarder will buffer the data locally in a file and attempt to send it again later. The amount of data it can buffer depends on its configuration. Data is not lost immediately.
No, you only install a Forwarder on the source machine. The full Splunk software (Indexer and Search Head) runs on separate servers. This keeps the source machine's resources free for its main task.
An index is a specific storage location on an Indexer that contains all the processed data from a particular source or collection of sources, such as 'web_server_logs' or 'firewall_logs'.
Yes, the Search Head provides the web interface that users use to run searches and create dashboards. Without a Search Head, you would have no way to query the indexed data.
You've finished Splunk Overview and Core Architecture. Continue through the SPLK-1002 study guide to build a complete picture of the exam.
Done with this chapter?