Splunk Engineer

Splunk Engineer

Location:

LOUISVILLE (Remote) Duration: 6 months

Client: TCS

Must Have Technical/Functional

Skills:

• Experience in Field Extractions and Transformations using the Reg Ex in Splunk.
• Experience in Installing, configuring and administering Splunk Enterprise on Linux and Windows servers.
• Installation and implementation of the Splunk App for Enterprise Security and documented best practices for the installation and performed knowledge transfer on the process.
• Worked on installing Universal Forwarders and Heavy Forwarders to bring any kind of data fields into Splunk.
• Experience in Writing Splunk Queries, Expertise in searching, monitoring, analyzing and visualizing Splunk logs.
• Experience in alert handling, standard availability and performance report generation.
• Experience in root cause analysis of post-production performance related issues through Splunk tool.
• Experience in Designing, optimizing and executing Splunk-based enterprise solutions.
• Should have Hands on experience in customizing Splunk dashboards, visualizations, configurations using customized Splunk queries.
• Monitored the Splunk infrastructure for capacity planning, scalability, and optimization.
• Experienced in using Splunk- DB connect for real-time data integration between Splunk Enterprise and rest all other databases.
• Expertise in Actuate Reporting, development, deployment, management and performance tuning of Actuate reports.
• Monitored license usage, indexing metrics, Index Performance, Forwarder performance, Splunk
• Configured Syslog server for the forwarding the logs to Splunk server via network protocols like TCP and UDP.
• Subject matter expert in best practices, security protocols, KPI, and other security-related issues.

Roles & Responsibilities:

• Architecture:
  Design for large-scale, geo-distributed Splunk environments (SHC, Indexer Clustering, DS).
• Performance Tuning:
  Optimizing data ingestion, indexing pipelines, search performance, and managing data retention (buckets).
• Data Models & Pivots:
  How to build, accelerate, and troubleshoot complex data models for ITSI.
• CIM:
  Best practices for CIM compliance and using it within ITSI.
• SPL:
  Advanced SPL for complex analytics, using stats, transaction, timechart, eval, rex, macros, and data enrichment.
• Service Modeling:
  Designing complex IT services, entity types, and dependencies in ITSI.
• KPIs & Thresholds:
  Creating, tuning, and managing KPIs (both metric & event) and dynamic thresholds; anomaly detection.
• Entity Health:
  How to define and monitor entity health, especially for complex infrastructure.
• Glass Tables:
  Designing impactful, real-time Glass Tables for different audiences (Execs, Ops).
• Event Correlation:
  How ITSI correlates raw events into service-impacting alerts (Service Analyzer, MITs).
• Alerting:
  Advanced ITSI alerting, integration with ITSM (Service Now), and managing alert fatigue.
• Troubleshooting:
  Diagnosing missing data, slow KPIs, and alert storms in an ITSI environment.
• AI/ML (ITSI):
  Using ITSI's built-in ML for anomaly detection (e.g., Seasonality, Thresholds) and predictive alerting.