SRE Splunk Admin

Primary Responsibilities

• Administer, configure, and maintain Splunk infrastructure, including indexers, search heads, forwarders, and deployment servers.
• Develop, optimize, and manage complex SPL queries, dashboards, reports, and alerts.
• Oversee the end-to-end data onboarding process, including data inputs, parsing, transformations, and indexing.
• Monitor Splunk platform health and performance, and proactively address issues.
• Implement best practices for Splunk performance, scalability, and high availability.
• Enforce security best practices, including role-based access control and data protection.
• Collaborate with application, infrastructure, and security teams to ensure smooth data onboarding and integration.
• Document Splunk configurations, dashboards, and operational procedures for internal use.

• Extensive experience with Splunk administration and development.
• Proficient in SPL (Search Processing Language) for creating and optimizing complex queries.
• Experience in creating custom dashboards, alerts, and reports in Splunk.
• Strong understanding of data onboarding, parsing, and indexing in Splunk.
• Deep knowledge of Splunk performance, scalability, and security best practices.
• Excellent troubleshooting and analytical skills for identifying and resolving Splunk-related issues.

• Experience with Splunk Enterprise Security (ES) or Splunk IT Service Intelligence (ITSI).
• Familiarity with cloud platforms like AWS, Azure, or GCP.
• Knowledge of scripting languages like Python or Bash.
• Splunk certifications (e.g., Power User, Admin, Architect) are a plus.