Role: Splunk Data Administrator

Type: Full Time / Contract

Location: Melbourne, AU

Status: AU valid visa with full work rights

Requisites:
5–10 years experience with Splunk administration and data onboarding (or equivalent depth).
Robust practical knowledge of:
CIM normalization, tags/eventtypes, datamodel alignment
Field extraction (regex, JSON/KV extraction), and troubleshooting parsing issues
props.conf / transforms.conf, sourcetypes, timestamps, line-breaking
TA installation/configuration and deployment patterns across Splunk tiers

• Experience with complex Splunk architectures:
Indexer clusters, SH/SHC, forwarder management, deployment server
Hybrid patterns (on-prem + cloud), connectivity, and ingestion strategies

• Comfortable writing and validating SPL for data quality and CIM compliance.
Solid log source knowledge across common domains:
Security: EDR, firewall, proxy, IAM/auth, VPN, email security
Infrastructure: Windows, Linux, network devices, virtualization
Cloud: AWS/Azure/GCP logging patterns (nice-to-have)

Interested? Please apply, thanks for your interest and time.

📌 Splunk Data Administrator Melbourne
🏢 FR Consultancy
📍 Melbourne