Role: Splunk Administrator
Industry Type: IT Services & Consulting
Department: IT & Information Security
Employment Type: Full Time, Permanent
Role Category: IT Security
UG: Any Graduate
Key Responsibilities
- Install, configure, upgrade, and administer Splunk Enterprise environments.
- Manage Splunk components including Search Heads, Indexers, Deployment Server, License Manager, Heavy Forwarders, and Universal Forwarders.
- Configure and maintain distributed Splunk architecture, including Indexer Clustering and Search Head Clustering.
- Onboard and manage log data from various sources including Windows, Linux, cloud platforms, applications, databases, and network devices.
- Configure data inputs, indexes, source types, props.conf, transforms.conf, and field extractions.
- Monitor Splunk infrastructure health and perform capacity planning.
- Troubleshoot data ingestion, search performance, indexing, and connectivity issues.
- Optimize search performance, dashboards, reports, alerts, and scheduled searches.
- Implement RBAC, authentication (LDAP/AD, SAML), SSL certificates, and security best practices.
- Manage backup, disaster recovery, and high availability configurations.
- Automate administrative tasks using Shell, Python, or PowerShell scripting.
- Collaborate with Security, Infrastructure, DevOps, and Application teams for log integration and monitoring.
- Create operational documentation, SOPs, and knowledge articles.