- Splunk Data Administrator
- Melbourne
- Permanent

We are looking for a Splunk Data Administrator this is Permanent role in Melbourne. Please email me at [email protected] for more information.

Required Skills:

- 5–10 years experience with Splunk administration and data onboarding (or equivalent depth).
- Robust practical knowledge of:
- CIM normalization, tags/eventtypes, datamodel alignment
- Field extraction (regex, JSON/KV extraction), and troubleshooting parsing issues
- TA installation/configuration and deployment patterns across Splunk tiers
- Experience with complex Splunk architectures:
- Indexer clusters, SH/SHC, forwarder management, deployment server
- Hybrid patterns (on-prem + cloud), connectivity, and ingestion strategies




- Comfortable writing and validating SPL for data quality and CIM compliance.
- Strong log source knowledge across common domains:
- Security: EDR, firewall, proxy, IAM/auth, VPN, email security
- Infrastructure: Windows, Linux, network devices, virtualization
- Cloud: AWS/Azure/GCP logging patterns (nice-to-have)

All candidates should have full working rights in Australia. Only shortlisted candidates will be contacted for this role.

To apply, please submit your resume ASAP for immediate consideration or email [email protected]

📌 Data Administrator (Melbourne)
🏢 ITbility
📍 Melbourne