1.1 Describe a deployment plan 2%

2.1 Identify critical information about environment, volume, users, and 5%

3.1 Understand design and size indexes 5%

4.1 List sizing considerations 7%

5.1 Identify non-smart store related storage and disk usage requirements 5%

6.1 Identify best practices for forwarder tier design 6%

7.1 Use limits.conf to improve performance 5%

8.1 Splunk diagnostic resources and tools 5%

9.1 Identify Splunk’s internal log files 5%

10.1 License issues 5%

11.1 Input issues 5%

12.1 Search issues 5%

13.1 Forwarding issues 5%

14.1 Identify Splunk server roles in clusters 5%

15.1 Splunk single-site indexer cluster configuration 5%

16.1 Splunk multisite indexer cluster overview 5%

17.1 Indexer cluster storage utilization options 7%

18.1 Splunk search head cluster overview 5%

19.1 Search head cluster deployer 5%

20.1 KV Store collection in Splunk clusters 3%

Question TypesMultiple Choice, Multiple Response

FormatLinear

Online ProctoringAvailable

ID RequirementsGovernment-issued photo ID required. Name on ID must match registration exactly.

RenewalRequired -- Recertify by passing the current version of the exam before expiry.

Retake Policy30-day waiting period between failed attempts. No limit on total attempts.

Splunk Enterprise Certified Architect (SPLK-1004) Exam Blueprint