Splunk Subject Matter Expert- Remote

Role Focus

Seeking a Splunk Subject Matter Expert with deep experience in Getting Data In (GDI) to support security and observability initiatives.

Core Responsibilities
Lead custom data onboarding across a diverse tool ecosystem
Configure and optimize parsing, including props.conf & transforms.conf
Re-evaluate existing tools as data sources for Security & Observability use cases
Support Splunk platform stability and scalability initiatives

Required Experience
Strong Splunk Enterprise (Core) experience
Hands-on expertise with:
oGDI / data ingestion pipelines
oCustom source onboarding
oParsing and data normalization
oProps & transforms configurations
Ability to work independently across multiple data sources

Preferred / Nice to Have
Experience upgrading Splunk instances to v10
General OT (Operational Technology) environment exposure
No requirement for Splunk Enterprise Security (ES)

Modules / Tooling
Core Splunk Enterprise only
ES not required