2.1 Splunk Components

Topic 1.1 — Splunk components

At User level you must identify the main Splunk components and what each one does. You are not expected to size clusters or configure indexer discovery like an admin, but you are expected to answer: Who collects data? Who stores it? Who searches it?

The core processing trio

Think of the flow as: data in at the forwarder → data stored at the indexer → data explored at the search head.

Forwarders

A forwarder is Splunk software installed close to data sources (servers, containers, endpoints). Its job is to gather inputs (files, syslog, Windows event logs, and more) and forward that data to indexers. Universal forwarders are common in production because they are lightweight collectors. As a User, remember the concept: forwarders do not replace indexers for long-term searchable storage in a typical distributed design — they ship data toward indexers.

Exam trap: Choosing "forwarder" as the place where analysts primarily run interactive searches. Interactive searching is a search head activity.

Indexers

An indexer receives data, processes it into events, builds the searchable index, and stores the compressed raw data and index files. When you search index=main error, the search head asks indexers to find matching events. Indexers do the heavy lifting of scanning and filtering at the storage layer.

Users select which indexes to search, but creating indexes, setting retention, or managing storage volumes is admin work — out of User primary scope.

Search heads

A search head is the component you experience most as a User: the web UI, the search bar, reports, dashboards, and knowledge objects you are allowed to use. It initiates searches, consolidates results from indexers (in distributed deployments), and renders visualizations.

In a single-instance learning environment, one Splunk install may act as search head and indexer (and sometimes receive data without a separate forwarder). Exam questions still expect you to know the logical roles, even when one machine wears multiple hats.

Other roles you should recognize (not the focus)

Splunk deployments can include additional components. Know the names and one-line purposes so distractors do not confuse you, but keep study time on the core trio:

• License manager — tracks and enforces Splunk license usage across the deployment.
• Deployment server — centrally manages configurations for deployment clients (often forwarders).

These matter operationally, but Domain 1.1 for User centers on how data is collected, indexed, and searched.

Single-instance vs distributed (User view)

Exam tip: If a question says "where is data stored for searching?" think indexer. If it says "where do you run a search in the UI?" think search head. If it says "what sends data from a remote server into Splunk?" think forwarder.

How components relate to User workflows

When you open Splunk Web, you are interacting with a search head. Your search string may include index=... to target data living on indexers. The events themselves likely arrived via forwarders (or other inputs) earlier. Understanding that chain prevents wrong answers that mix "collect," "store," and "search."

Example scenario:

1. A web server has a universal forwarder reading /var/log/nginx/access.log.
2. The forwarder sends events to an indexer, which stores them in index=web.
3. You log into Splunk Web on the search head, open Search & Reporting, and run index=web status=500.

Each step maps to a component. User questions often stop at identification; they rarely ask you to configure outputs.conf.

Common misconceptions

• "The search head stores all the raw logs." — No; long-term indexed storage is the indexer's role in distributed designs.
• "Indexers are only for admins, Users ignore them." — Users must still understand what an indexer is and may specify indexes in searches (Domain 4.3).
• "Apps replace components." — Apps package UI and configurations; they do not replace forwarder/indexer/search head architecture.

Quick self-check

• Name the three core components and one verb for each: collect/forward, index/store, search/UI.
• Explain why a laptop lab can still teach component concepts when roles share one host.
• Distinguish license manager / deployment server from the data path without deep-diving Admin setup.

Master this vocabulary before Domain 1.2. The next section answers why organizations run Splunk at all — search, analyze, and visualize machine data across security, IT, and business use cases.