- Splunk Data Administrator

- Melbourne

- Permanent

We are looking for a

Splunk Data Administrator this is Permanent role in

Melbourne

. Please email me at [email protected] for more information.

Required Skills:

- 5–10 years experience with Splunk administration and data onboarding (or equivalent depth).

- Robust practical knowledge of:

- CIM normalization, tags/eventtypes, datamodel alignment

- Field extraction (regex, JSON/KV extraction), and troubleshooting parsing issues

- TA installation/configuration and deployment patterns across Splunk tiers

- Experience with complex Splunk architectures:

- Indexer clusters, SH/SHC, forwarder management, deployment server

- Hybrid patterns (on-prem + cloud), connectivity, and ingestion strategies





- Comfortable writing and validating SPL for data quality and CIM compliance.

- Strong log source knowledge across common domains:

- Security: EDR, firewall, proxy, IAM/auth, VPN, email security

- Infrastructure: Windows, Linux, network devices, virtualization

- Cloud: AWS/Azure/GCP logging patterns (nice-to-have)

All candidates should have full working rights in Australia. Only shortlisted candidates will be contacted for this role.

To apply, please submit your resume ASAP for immediate consideration or email [email protected]

📌 Data Administrator (Melbourne)
🏢 ITbility
📍 Melbourne