Splunk Observability

Role Purpose

The purpose of the role is to create exceptional architectural solution design and thought leadership and enable delivery teams to provide exceptional client engagement and satisfaction.

Position:

Splunk Administrator (Enterprise Observability Platform Operations) Location: PAN India Total years of experience : 10 yrs to 17yrs

Role Summary:

We are seeking a Splunk Administrator to support day‑to‑day operations of the Enterprise Observability- Splunk suite platform (Splunk Enterprise, ITSI, and Splunk Observability Cloud), including data onboarding, system maintenance, monitoring, troubleshooting, and user support. This is a hands‑on Splunk support operations role supporting a mission‑critical environment that requires hands‑on collaboration with engineering, operations, and application teams.

Key Responsibilities

Platform Administration & Daily Operations Monitor Splunk Enterprise platform health, performance, and capacity. Perform routine administrative tasks: restarts, configuration updates, index management, and license monitoring. Support search head and indexer cluster operations under guidance from senior engineers. Maintain forwarder configurations and ensure reliable data ingestion. Data Onboarding & Configuration Onboard new data sources using forwarders, APIs, add‑ons, and cloud integrations. Configure inputs, props/transforms, sourcetypes, and parsing rules. Validate data quality, field extractions, and CIM compliance. Maintain and update Technology Add‑Ons (TAs) as needed. ITSI & Observability Support Assist with ITSI KPI updates, service model maintenance, and correlation search tuning. Support troubleshooting of ITSI lag, KPI failures, and service health issues. Help maintain integrations with Splunk Observability Cloud (O11y) and OpenTelemetry collectors. User Support & Operational Requests Provide support to internal users for searches, dashboards, alerts, and knowledge objects. Assist teams with troubleshooting search performance and data visibility issues. Maintain documentation, runbooks, and onboarding guides. Incident & Problem Management Participate in incident response for Splunk‑related issues. Investigate ingestion failures, search errors, and platform alerts. Support root cause analysis and implement corrective actions. Governance & Best Practices Follow established standards for data onboarding, index naming, retention, and tagging. Ensure compliance with security, audit, and logging requirements. Maintain accurate documentation of configurations and operational procedures. Required Skills & Experience Technical Skills 4–6 years of hands‑on experience administering Splunk Enterprise. Strong understanding of forwarders, inputs, parsing, indexing, and search optimization. Experience with Linux/Unix environments and basic scripting (Bash, Python). Familiarity with ITSI concepts (KPIs, services, correlation searches) is a plus. Exposure to cloud platforms (AWS and Azure) and hybrid environments. Understanding of logging standards, observability concepts, and monitoring tools.