Cribl Observability Consultant; Cribl Stream Engineer
Listed on 2026-10-14
-
IT/Tech
Data Engineering, Cybersecurity
Charlotte, United States | Posted on 10/03/2026
We're looking for a hands-on Cribl Consultant to enable our Cribl platform and onboard Splunk data sources through Cribl Stream. You'll build data pipelines that filter, shape and route data to Splunk, improving data quality and reducing ingest volume and cost.
ResponsibilitiesSet up and configure the Cribl Stream platform:
Leader, Worker Groups, Sources, Destinations, Routes and Pipelines.
Onboard Splunk data sources through Cribl Stream, including traffic from Splunk Universal Forwarders and Heavy Forwarders (Splunk-to-Splunk and HEC).
Build and maintain data pipelines using Cribl functions for filtering, parsing, masking, sampling, enrichment and aggregation.
Stream data from Cribl to Splunk indexers and Splunk Cloud, keeping source type, index and field alignment intact.
Reduce data volume by dropping low-value events and fields, and measure the ingest and license savings.
Validate data before and after onboarding so it arrives complete and in the right format in Splunk.
Monitor Cribl health and throughput, and troubleshoot data flow issues across Cribl and Splunk.
Document pipelines, routing logic and onboarding standards, and support knowledge transfer to internal teams.
Requirements3–5+ years in data engineering, observability or log management.
Hands-on experience with Cribl Stream:
Sources, Destinations, Routes, Pipelines and Packs.
Cribl certification (such as Cribl Certified Observability Engineer or Cribl Stream Admin).
Experience building data filtering and data pipelines for log and event data.
Working knowledge of Splunk architecture , especially the Universal Forwarder (UF), Heavy Forwarder (HF) and indexer, and how data flows between them.
Familiarity with Splunk source types, indexes, and props.conf and transforms.conf.
Understanding of data formats and parsing: JSON, syslog, key-value and regex.
Nice to have (Will be an advantage)Experience with Cribl Edge, Cribl Lake or Cribl Search.
Experience with cloud data sources (AWS Cloud Trail, Cloud Watch, S3).
Experience with Splunk Cloud or Splunk-to-Cloud migrations.
Splunk certification (such as Splunk Enterprise Certified Admin).
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).