Job Description

Role Purpose
The purpose of this role is to support delivery through development and deployment of tools. 
 

͏

Title: Splunk core

Total years of experience: 6yrs to 17yrs

Location: PAN India

Position: Splunk Core SME

Location: Pune / Bangalore / Hyderabad (In-person)

Role Summary:

We are building a modern Enterprise Observability Platform for our clients leveraging the Splunk suite (Splunk Core, ITSI, O11y). We are seeking a Splunk Core Subject Matter Expert (SME) to join our day‑to‑day operations team. This role is responsible for maintaining platform stability, ensuring high‑quality data ingestion, supporting observability use cases, and partnering with service owners to deliver actionable insights across infrastructure, applications, and business services.

This is a hands‑on engineering and operations role for someone who thrives in complex, high‑availability environments.

Key Responsibilities

Platform Operations & Administration

• Manage daily operations of Splunk Enterprise (indexers, search heads, cluster managers, forwarders).
• Monitor platform health, capacity, performance, and ingestion pipelines.
• Perform upgrades, patching, scaling, and maintenance activities.
• Troubleshoot search performance, ingestion delays, and system bottlenecks.

Data Onboarding & Pipeline Management

• Onboard new data sources using forwarders, APIs, OTel collectors, and cloud integrations.
• Ensure data quality, normalization (CIM), and adherence to logging standards.
• Maintain TA configurations, props/transforms, and ingestion routing.

ITSI (IT Service Intelligence) Support

• Support and maintain ITSI service models, KPIs, correlation searches, and glass tables.
• Troubleshoot ITSI performance issues, KPI lag, and service health scoring.
• Partner with service owners to refine KPIs and improve observability maturity.

͏

Splunk Observability Cloud (O11y) Support

• Assist with O11y components such as Infrastructure Monitoring, APM, RUM, and Log Observer.
• Support OpenTelemetry (OTel) collector deployments and pipeline tuning.
• Help correlate metrics, traces, and logs across the observability stack.

Incident, Problem & Change Management

• Provide operational support for incidents, outages, and performance degradations.
• Participate in on‑call rotation for platform‑related issues.
• Document root cause analysis and drive long‑term remediation.

Governance, Standards & Best Practices

• Enforce data onboarding standards, retention policies, and index management.
• Maintain documentation, runbooks, and operational procedures.
• Ensure compliance with security, audit, and regulatory requirements.

Cross‑Team Collaboration

• Work closely with SRE, DevOps, Cloud, Security, and Application teams.
• Provide SME guidance on Splunk Core and Observability best practices.
• Support onboarding of new teams and services into the Observability Platform.

Required Skills & Experience

Technical Expertise

• Strong hands‑on experience with Splunk Enterprise (Core) in large, distributed environments.
• Deep understanding of indexer clustering, search head clustering, and forwarder management.
• Experience with ITSI (KPIs, services, correlation searches, glass tables).
• Familiarity with Splunk Observability Cloud (O11y) and OpenTelemetry.
• Strong Linux/Unix administration and scripting (Bash, Python).
• Experience with cloud platforms (AWS, Azure) and hybrid architectures.

Operational Skills

• Experience supporting 24x7 production environments.
• Strong troubleshooting skills across ingestion, search, and infrastructure layers.
• Ability to interpret logs, metrics, and traces to diagnose issues.

Soft Skills

• Excellent communication and documentation habits.
• Ability to work collaboratively in a fast‑paced, cross‑functional environment.
• Strong ownership mindset and attention to detail.

Preferred Qualifications

• Splunk certifications (Core Consultant, Admin, Architect, ITSI, Observability).
• Experience with AIOps, event correlation, or service health modeling.
• Familiarity with CI/CD, automation, and infrastructure‑as‑code.
• Experience in large enterprise, Pharma and Life Science environments.

͏

͏