Description

Manage and maintain multi-site Splunk Search Head and Indexer clusters to ensure stability and correct configuration.

This role is hybrid.

Responsibilities

• Maintain Splunk clusters, ensuring stability, replication, and configuration integrity.
• Manage Heavy Forwarders, Universal Forwarders, and Deployment Servers, including rollout and troubleshooting.
• Integrate and onboard logs from Unix and Windows sources, diagnosing data ingestion issues.
• Modify configuration files (props.conf, transforms.conf, inputs.conf) and manage add-ons like DB Connect and ServiceNow.
• Create and tune reports, alerts, dashboards, and ITSI use cases while supporting security hardening.

Required Skills

• 5-15 years of experience in Splunk administration and log management.
• Deep knowledge of Splunk Enterprise administration and operational support.
• Experience managing Search Head/Indexer clusters and forwarder deployments.
• Proficiency in configuration management using props.conf, transforms.conf, and inputs.conf.
• Ability to monitor and optimize Splunk performance, including access control.
• Experience integrating Splunk with SIEM or Enterprise Security.
• Proficiency in Unix and Windows environments.

Preferred Skills

• Experience administering Splunk in enterprise environments with ITSI.
• Background in security-focused use cases and performance optimization.

Key Skills

Education

Any Graduate