Splunk Engineer
Location: LOUISVILLE (Remote)
Duration: 6 months
Client: TCSMust Have Technical/Functional Skills:
Experience in Field Extractions and Transformations using the RegEx in Splunk. Experience in Installing, configuring and administering Splunk Enterprise on Linux and Windows servers. Installation and implementation of the Splunk App for Enterprise Security and documented best practices for the installation and performed knowledge transfer on the process. Worked on installing Universal Forwarders and Heavy Forwarders to bring any kind of data fields into Splunk. Experience in Writing Splunk Queries, Expertise in searching, monitoring, analyzing and visualizing Splunk logs. Experience in alert handling, standard availability and performance report generation. Experience in root cause analysis of post-production performance related issues through Splunk tool. Experience in Designing, optimizing and executing Splunk-based enterprise solutions. Should have Hands on experience in customizing Splunk dashboards, visualizations, configurations using customized Splunk queries. Monitored the Splunk infrastructure for capacity planning, scalability, and optimization. Experienced in using Splunk- DB connect for real-time data integration between Splunk Enterprise and rest all other databases. Expertise in Actuate Reporting, development, deployment, management and performance tuning of Actuate reports. Monitored license usage, indexing metrics, Index Performance, Forwarder performance, Splunk Configured Syslog server for the forwarding the logs to Splunk server via network protocols like TCP and UDP.Subject matter expert in best practices, security protocols, KPI, and other security-related issues.
Roles & Responsibilities:
Architecture: Design for large-scale, geo-distributed Splunk environments (SHC, Indexer Clustering, DS).Performance Tuning: Optimizing data ingestion, indexing pipelines, search performance, and managing data retention (buckets).Data Models & Pivots: How to build, accelerate, and troubleshoot complex data models for ITSI.CIM: Best practices for CIM compliance and using it within ITSI.SPL: Advanced SPL for complex analytics, using stats, transaction, timechart, eval, rex, macros, and data enrichment.
Service Modeling: Designing complex IT services, entity types, and dependencies in ITSI.KPIs & Thresholds: Creating, tuning, and managing KPIs (both metric & event) and dynamic thresholds; anomaly detection.
Entity Health: How to define and monitor entity health, especially for complex infrastructure.
Glass Tables: Designing impactful, real-time Glass Tables for different audiences (Execs, Ops).Event Correlation: How ITSI correlates raw events into service-impacting alerts (Service Analyzer, MITs).Alerting: Advanced ITSI alerting, integration with ITSM (ServiceNow), and managing alert fatigue.
Troubleshooting: Diagnosing missing data, slow KPIs, and alert storms in an ITSI environment.
AI/ML (ITSI): Using ITSI's built-in ML for anomaly detection (e.g., Seasonality, Thresholds) and predictive alerting.
