Splunk Developer

Job Description – Splunk SMEPosition

Splunk Subject Matter Expert (SME)

Experience : 5+ Years

Engagement : Contract / Project-Based – Minimum 3 Months

Work Location : Melbourne (WFH) As per Client Requirement

Eligibility: Valid Australian work permit authorization.

Role Overview

We are looking for a highly skilled and experienced strong Splunk SME to support Splunk platform upgrade activities and other Splunk-related technical initiatives across the organisation.

The successful candidate will be responsible for performing on-premise Splunk version upgrades, troubleshooting and resolving platform-related issues, and providing expert technical support for various Splunk projects. The candidate should have strong hands-on experience in Splunk administration, architecture, upgrades, configuration, monitoring, and troubleshooting.

Key Responsibilities

• Plan and execute Splunk version upgrades for on-premise Splunk environments.
• Assess the existing Splunk environment and identify upgrade prerequisites, dependencies, compatibility issues, and potential risks.
• Develop and execute upgrade plans, including pre-upgrade checks, implementation, validation, and post-upgrade activities.
• Perform Splunk upgrades across relevant components such as Search Heads, Indexers, Cluster Managers, Deployment Servers, and Forwarders, as applicable.
• Ensure minimal disruption to Splunk services during upgrade activities.
• Perform health checks and validation of the Splunk platform before and after upgrades.
• Troubleshoot and resolve Splunk platform, indexing, search, ingestion, and configuration issues.
• Support Splunk configuration, administration, performance tuning, monitoring, and optimisation activities.
• Work with Splunk Enterprise, Universal Forwarders and Heavy Forwarders as required.
• Analyse and resolve issues related to data ingestion, parsing, indexing, search performance, alerts, dashboards, and knowledge objects.
• Support Splunk integration with various infrastructure, applications, security tools, and data sources.
• Perform other Splunk-related technical tasks associated with ongoing projects.
• Review existing Splunk architecture and recommend improvements where required.
• Ensure appropriate backup, rollback, and recovery procedures are in place for upgrade activities.
• Prepare and maintain technical documentation, upgrade procedures, configuration details, and implementation records.
• Collaborate with infrastructure, security, application, network, and project teams during Splunk activities.
• Provide technical guidance and act as the Splunk Subject Matter Expert for project stakeholders.
• Participate in troubleshooting, technical discussions, and knowledge-transfer sessions.

Required Technical Skills

• 5+ years of hands-on experience with Splunk Enterprise.
• Strong expertise in Splunk administration and platform management.
• Strong experience performing Splunk version upgrades in on-premise environments.
• Hands-on experience with:
• Splunk Search Head
• Splunk Indexers
• Cluster Manager / Master Node
• Deployment Server
• Universal Forwarders
• Heavy Forwarders
• Good understanding of Splunk distributed architecture and clustering.
• Experience with Splunk configuration files such as indexes.conf, props.conf, transforms.conf, inputs.conf, and outputs.conf.
• Strong knowledge of data ingestion, indexing, parsing, field extraction, and search.
• Good experience with SPL (Search Processing Language).
• Experience troubleshooting Splunk performance and platform issues.
• Knowledge of Splunk alerts, reports, dashboards, lookups, knowledge objects, and data models.
• Experience with Splunk monitoring and health checks.
• Understanding of Linux/Unix operating systems and basic shell scripting.
• Experience with enterprise infrastructure and application log integrations.
• Strong troubleshooting and analytical skills.

Pay: From $85,000.00 per year

Benefits:

• Referral program
• Visa sponsorship
• Work from home

Experience:

• Splunk: 5 years (Required)
• IT: 5 years (Required)
• Telecommunication: 5 years (Required)

Work Authorisation:

• Australia (Required)

Location:

• Carlton VIC (Required)

Work Location: Hybrid remote in Carlton VIC