Splunk Administrator

About the role

Design, implement, administer, and maintain the enterprise Splunk platform. Manage Splunk infrastructure components and optimize platform performance across the organization.

Key responsibilities

• Design, implement, administer, and maintain the enterprise Splunk platform.
• Manage Splunk infrastructure components including Search Heads, Indexers, Deployment Servers, Heavy Forwarders, Universal Forwarders, Cluster Manager, License Manager, and Deployer.
• Configure and maintain Search Head Clusters and Indexer Clusters.
• Administer data onboarding, source type configuration, parsing, indexing, and data retention.
• Monitor Splunk platform health, performance, availability, and capacity.
• Perform Splunk upgrades, patching, migration, and infrastructure expansion activities.
• Optimize indexes, searches, data models, and platform performance.
• Develop automation scripts using Python or similar scripting languages.
• Integrate Splunk with various enterprise systems and data sources.
• Support troubleshooting and root cause analysis related to Splunk platform and data ingestion issues.

About you

• Bachelor's Degree in Computer Science, Information Technology, or related discipline.
• Minimum 8 years of IT experience with at least 5 years of hands-on Splunk Administration experience.
• Strong experience managing Search Head Clusters, Indexer Clusters, Deployment Servers, Heavy Forwarders, Universal Forwarders, and License Management.
• Strong understanding of Splunk architecture, deployment models, and platform sizing.
• Experience with Splunk upgrades, platform scaling, and infrastructure lifecycle management.
• Expertise in Splunk SPL and platform performance tuning.
• Experience onboarding and integrating diverse log sources into Splunk.
• Strong understanding of Linux, networking, virtualization, storage, and enterprise infrastructure.
• Splunk Certified Admin (preferred).
• Experience with Python, REST APIs, or automation scripting (preferred).