Job Description

Role Purpose
The purpose of this role is to support delivery through development and deployment of tools. 
 

͏

Position: Splunk Administrator (Enterprise Observability Platform Operations)

Location: Pune / Bangalore / Hyderabad (In-person- 24x7 Rotational)

Role Summary:

We are seeking a Splunk Administrator to support day‑to‑day operations of the Enterprise Observability- Splunk suite platform (Splunk Enterprise, ITSI, and Splunk Observability Cloud), including data onboarding, system maintenance, monitoring, troubleshooting, and user support.

This is a hands‑on Splunk support operations role supporting a mission‑critical environment that requires hands‑on collaboration with engineering, operations, and application teams.

Key Responsibilities

Platform Administration & Daily Operations

• Monitor Splunk Enterprise platform health, performance, and capacity.
• Perform routine administrative tasks: restarts, configuration updates, index management, and license monitoring.
• Support search head and indexer cluster operations under guidance from senior engineers.
• Maintain forwarder configurations and ensure reliable data ingestion.

͏

Data Onboarding & Configuration

• Onboard new data sources using forwarders, APIs, add‑ons, and cloud integrations.
• Configure inputs, props/transforms, sourcetypes, and parsing rules.
• Validate data quality, field extractions, and CIM compliance.
• Maintain and update Technology Add‑Ons (TAs) as needed.

ITSI & Observability Support

• Assist with ITSI KPI updates, service model maintenance, and correlation search tuning.
• Support troubleshooting of ITSI lag, KPI failures, and service health issues.
• Help maintain integrations with Splunk Observability Cloud (O11y) and OpenTelemetry collectors.

User Support & Operational Requests

• Provide support to internal users for searches, dashboards, alerts, and knowledge objects.
• Assist teams with troubleshooting search performance and data visibility issues.
• Maintain documentation, runbooks, and onboarding guides.

Incident & Problem Management

• Participate in incident response for Splunk‑related issues.
• Investigate ingestion failures, search errors, and platform alerts.
• Support root cause analysis and implement corrective actions.

Governance & Best Practices

• Follow established standards for data onboarding, index naming, retention, and tagging.
• Ensure compliance with security, audit, and logging requirements.
• Maintain accurate documentation of configurations and operational procedures.

Required Skills & Experience

Technical Skills

• 4–6 years of hands‑on experience administering Splunk Enterprise.
• Strong understanding of forwarders, inputs, parsing, indexing, and search optimization.
• Experience with Linux/Unix environments and basic scripting (Bash, Python).
• Familiarity with ITSI concepts (KPIs, services, correlation searches) is a plus.
• Exposure to cloud platforms (AWS and Azure) and hybrid environments.
• Understanding of logging standards, observability concepts, and monitoring tools.

Operational Skills

• Experience supporting production environments with stringent SLAs.
• Strong troubleshooting skills across ingestion, parsing, and search layers.
• Ability to follow change management and incident management processes.

Soft Skills

• Strong communication and documentation abilities.
• Ability to collaborate with cross‑functional teams.
• Detail‑oriented, reliable, and proactive in identifying issues.

Preferred Qualifications

• Splunk Power User or Admin certification.
• Experience with ITSI, O11y, or OpenTelemetry.
• Familiarity with ServiceNow, Jira, or similar ITSM tools.
• Experience in enterprise, Pharma and Life Science environments.

͏