Splunk Subject Matter Expert- Remote

Role Focus

Seeking a Splunk Subject Matter Expert with deep experience in Getting Data In (GDI) to support security and observability initiatives.

Core Responsibilities

• Lead custom data onboarding across a diverse tool ecosystem
• Configure and optimize parsing, including props.conf & transforms.conf
• Re-evaluate existing tools as data sources for Security & Observability use cases
• Support Splunk platform stability and scalability initiatives

Required Experience

• Strong Splunk Enterprise (Core) experience
• Hands-on expertise with:
• oGDI / data ingestion pipelines
• oCustom source onboarding
• oParsing and data normalization
• oProps & transforms configurations
• Ability to work independently across multiple data sources

Preferred / Nice to Have

• Experience upgrading Splunk instances to v10
• General OT (Operational Technology) environment exposure
• No requirement for Splunk Enterprise Security (ES)

Modules / Tooling

• Core Splunk Enterprise only
• ES not required