- 5–10 years experience with Splunk administration and data onboarding (or equivalent depth).
- Robust practical knowledge of:
- Field extraction (regex, JSON/KV extraction), and troubleshooting parsing issues
- props.conf / transforms.conf, sourcetypes, timestamps, line-breaking
- TA installation/configuration and deployment patterns across Splunk tiers
- Experience with complex Splunk architectures:
- Indexer clusters, SH/SHC, forwarder management, deployment server
- Hybrid patterns (on-prem + cloud), connectivity, and ingestion strategies
- Comfortable writing and validating SPL for data quality and CIM compliance.