Splunk Engineer

Job Title

Job Description:

10+ years of overall technology experience

2–3 years of hands-on Splunk experience, preferably with Splunk Enterprise or Splunk Cloud

2–3 years of log analysis and SRE experience

Strong knowledge of SPL (Search Processing Language), including commands such as stats, timechart, transaction, eval, rex, lookup, and mv

Experience building interactive dashboards, drilldowns, and scheduled/ad-hoc reports

Solid experience with field extractions using regex, search-time extractions, and lookups

Understanding of indexes, sourcetypes, hosts, and search-time vs. index-time concepts

Familiarity with JSON, XML, CSV, and standard log formats

Basic understanding of Linux/Unix commands for log analysis

Ability to analyze data and present insights in a clear visual format

Strong stakeholder collaboration and communication skills

Documentation discipline for dashboards, reports, and searches

Strong understanding of TCP/IP, UDP, DNS, DHCP, SSL/TLS, FTP, and SMTP protocols.

Experience onboarding and analyzing logs from routers, switches, firewalls, load balancers, IDS/IPS, and VPN devices.

Configured Syslog, SNMP, NetFlow, sFlow, and REST API data ingestion into Splunk.

Troubleshooting log forwarding issues between Universal Forwarders, Heavy Forwarders, Indexers, and Search Heads.

Built SPL searches and correlation rules for detecting network anomalies, DDoS attacks, unauthorized access, port scans, and suspicious traffic patterns.

Integrated Splunk with network monitoring tools such as SolarWinds, Cisco Prime, ThousandEyes, and Dynatrace.