Splunk Administrator

Role & responsibilities

The experience should be around 10 years and package can be INR 12-15 Lakhs per annum. I will appreciate on sharing of the profiles on priority, please.

JD as below.

Level L4.

Location – Chennai.

Time Zone – Australian Business Hours.

highly skilled Splunk ITSI Admin with solid experience in Splunk Administration. The successful candidate will manage the configuration, deployment, and maintenance of Splunk IT Service Intelligence (ITSI), as well as other Splunk components in a complex environment. The role will involve building and maintaining dashboards, alerts, and KPI-driven visualizations to provide real-time insights and monitoring capabilities.

Key Responsibilities:

Splunk ITSI Management:

• Administer and manage Splunk ITSI modules, including service and KPI creation, glass table design, and correlation searches.

• Create and maintain ITSI Service Health Scores and Glass Tables to provide real-time visualization of critical services and their KPIs.

• Fine-tune ITSI correlation searches to optimize event correlation and incident management.

• Design and implement KPI-based thresholds and alerts for service health monitoring and event detection.

Splunk Dashboard & Visualization:

• Design, develop, and maintain custom dashboards in Splunk and Splunk ITSI using SPL, panels, and visualization techniques.

• Create dashboards for real-time monitoring, reporting, and performance tracking based on IT operational data

Splunk Alerts & Monitoring:

• Design, configure, and maintain alerts based on defined KPI thresholds, searches, and correlation rules in Splunk and Splunk ITSI.

• Create and maintain ITSI Episode Review policies to manage events and incidents efficiently.

• Automate alert management workflows for efficient incident response.

• Splunk Administration:

Operational Support:

• Act as a subject matter expert (SME) for Splunk ITSI and Splunk Dashboards within the organization.

• Troubleshoot and resolve performance, configuration, and indexing issues in Splunk and ITSI.

• Ensure compliance with security standards, policies, and audit requirements.

• Performance & Capacity Planning:

Automation & Optimization:

• Automate Splunk configurations using deployment server, REST APIs, or orchestration tools.

• Continuously optimize Splunk Dashboards for performance and efficiency.

Incident Management & Reporting:

• Work with Service Operations Teams to create proactive monitoring alerts.

• Generate and maintain reports for system performance, availability, and capacity.

• Assist in the development and delivery of regular reports, alerts, and dashboards for business stakeholders using Splunk and ITSI.

Required Qualifications:

• 5+ years of experience working with Splunk as an admin, including multi-site indexer clusters.

• 2+ years of experience managing and deploying Splunk ITSI with in-depth knowledge of service monitoring, glass tables, KPI creation, and episode management.

• Expertise in creating and managing Splunk Dashboards and Alerts using SPL and ITSI.

• Strong skills in SPL (Search Processing Language) for building queries, reports, and dashboards.

• Proficiency in creating alerts, managing correlation searches, and configuring escalation workflows.

• Experience with scripting languages like Python or Shell for automation purposes.

• Strong understanding of networking concepts, Linux administration, and security monitoring.

• Experience with data onboarding, parsing, indexing, and knowledge object creation in Splunk.

• Splunk certifications (Splunk Admin, Splunk ITSI Implementation) are a strong plus.