Splunk Administration

Job Description

Install, configure, maintain, and upgrade Splunk Enterprise environments. Administer Splunk components including Search Heads, indexers, Universal Forwarders, Deployment Servers. Heavy Forwarders, and Configure and manage data inputs, indexes, source types, and data retention policies. Onboard logs from applications, servers, databases, network devices, and cloud platforms. Create and troubleshoot SPL queries, dashboards, reports, alerts, and scheduled searches. Monitor Splunk infrastructure health, indexing performance, search performance, and license utilization. Troubleshoot issues related to log ingestion, parsing, indexing, and search performance. Manage Splunk users, roles, authentication, and access permissions. Perform performance tuning, capacity planning, patching, and configuration changes. Maintain Splunk configuration files such as inputs.conf, outputs.conf, props.conf, transforms.conf, and indexes.conf. Support production incidents and coordinate with Infrastructure, DevOps, Application, and Security teams. Maintain technical documentation and operational procedures.

Key Responsibilities

• 3+ years of hands-on experience with Splunk Administration. Strong knowledge of Splunk
• Enterprise architecture and SPL. Experience with Linux/Unix environments.
• Good understanding of TCP/IP, DNS, HTTP/HTTPS, and SSL/TLS.
• Strong troubleshooting and analytical skills.
• Basic scripting knowledge in Shell or Python is an advantage.

Professional Skills

• Troubleshooting
• Analytical skill
• python
• Linux and Unix
• Splunk