- Splunk Data Administrator
- Melbourne
- Contract 6+ Months / Permanent

Our client in Melbourne is looking for Splunk Data Administrator this is a contract 6+ months or Permanent role. Please email me at [email protected] for more information.

:

- Lead onboarding of recent log sources end-to-end: requirements gathering, source validation, parsing strategy, TA selection/deployment, CIM alignment, testing, and release.
- Partner with Security/IT teams to translate use-cases into data requirements, ensuring sources deliver the right fidelity, timeliness, and coverage.
- Manage onboarding at scale using best practices for source types, metadata strategy, index & sourcetype governance, and naming conventions.
- Define and enforce data quality standards (field completeness, timestamps, event consistency, parsing accuracy, duplication control).

CIM Normalization & Data Modelling
- Normalize data to Splunk Common Information Model (CIM) with strong understanding of data models (e.g., Authentication, Network Traffic, Endpoint, Change, etc.).
- Ensure fields are aligned to CIM requirements to support Splunk Enterprise Security (ES) and other CIM-based content.
- Validate normalization using SPL and develop reusable onboarding checklists.

Field Extraction, Parsing & Enrichment
- Design and implement robust field extractions using:

- props.conf / transforms.conf, REPORT/TRANSFORMS stanzas
- regex and structured parsing (KV_MODE, JSON, XML)
- ingest-time vs search-time extraction strategy
- sourcetype / timestamp / line breaking configuration

• Implement enrichment and routing using event breaking, host/source normalization, lookups,



and tagging.
- Troubleshoot parsing issues (timestamp drift, multi-line events, encoding, truncation, duplicate ingestion, broken extractions).

TA Installation & Configuration (Complex / Hybrid)
- Install, configure, and maintain Splunk Add-ons (TAs) and apps across:

- Heavy Forwarders / Universal Forwarders
- Indexers / Search Heads / SHC
- Deployment Server / Cluster Manager (where applicable)

• Maintain version compatibility and upgrade strategies for:
- Splunk Enterprise / Splunk Cloud
- Add-ons, apps, and content packs

• Package and deploy TAs using deployment pipelines and change management controls.
- Ensure fields are aligned to CIM requirements

Hybrid Splunk Architecture Operations

- Operate and support Splunk in complex environments:

- On-prem Indexer Cluster, Search Head Cluster, Forwarder tiers
- Splunk Cloud integrations where applicable (e.g., Heavy Forwarder, VPN, PrivateLink, data forwarding patterns)

• Configure and troubleshoot data ingestion pipelines:
- Syslog (UDP/TCP), API-based collection, HEC, file monitors, Windows Event Logs, cloud sources

• Ensure performance and reliability across the pipeline, including indexing throughput, parsing overhead, and search impact.




- 5–10 years experience with Splunk administration and data onboarding (or equivalent depth).
- Strong practical knowledge of:

- CIM normalization, tags/eventtypes, datamodel alignment
- Field extraction (regex, JSON/KV extraction), and troubleshooting parsing issues
- props.conf / transforms.conf, sourcetypes, timestamps, line-breaking
- TA installation/configuration and deployment patterns across Splunk tiers

• Experience with complex Splunk architectures:
- Indexer clusters, SH/SHC, forwarder management, deployment server
- Hybrid patterns (on-prem + cloud), connectivity, and ingestion strategies

• Comfortable writing and validating SPL for data quality and CIM compliance.
- Strong log source knowledge across common domains:

- Security: EDR, firewall, proxy, IAM/auth, VPN, email security
- Infrastructure: Windows, Linux, network devices, virtualization
- Cloud: AWS/Azure/GCP logging patterns (nice-to-have)

Preferred / Nice-to-Have
- Experience with Splunk Enterprise Security (ES) and ES add-ons / CIM compliance expectations.
- Knowledge of Splunk Ingest Actions / Edge Processor (or modern ingestion tools, where applicable).
- Familiarity with:

- HEC, API ingestion, message queues

- ITSI / Observability (bonus)

• Splunk certifications (preferred):
- Splunk Core Certified Power User / Admin

- Splunk Enterprise Certified Admin

- Splunk ES Admin (bonus)

Only shortlisted candidates will be contacted for this role. To apply, please submit your resume ASAP for immediate consideration or email [email protected]

📌 Splunk Data Administrator (Melbourne)
🏢 ITbility
📍 Melbourne