Experience: 5 Years

Job Summary

We are looking for a skilled Splunk Administrator to manage, maintain, and optimize our Splunk environment. The candidate will be responsible for log ingestion, platform administration, monitoring, troubleshooting, dashboards,

alerts, and user access management.

Key Responsibilities

- Install, configure, maintain, and upgrade Splunk Enterprise environments.
- Administer Splunk components including Search Heads, Indexers, Universal Forwarders, Heavy Forwarders,

and Deployment Servers.
- Configure and manage data inputs, indexes, sourcetypes, and data retention policies.
- Onboard logs from applications, servers, databases, network devices, and cloud platforms.
- Create and troubleshoot SPL queries, dashboards, reports, alerts, and scheduled searches.
- Monitor Splunk infrastructure health, indexing performance, search performance, and license utilization.
- Troubleshoot issues related to log ingestion, parsing, indexing, and search performance.
- Manage Splunk users, roles, authentication, and access permissions.
- Perform performance tuning, capacity planning, patching, and configuration changes.
- Maintain Splunk configuration files such as inputs.conf, outputs.conf, props.conf, transforms.conf, and

indexes.conf.
- Support production incidents and coordinate with Infrastructure, DevOps, Application, and Security teams.
- Maintain technical documentation and operational procedures.

Required Skills

- 4+ years of hands-on experience with Splunk Administration.
- Strong knowledge of Splunk Enterprise architecture and SPL.




- Experience with Linux/Unix environments.
- Positive understanding of TCP/IP, DNS, HTTP/HTTPS, and SSL/TLS.
- Strong troubleshooting and analytical skills.
- Basic scripting knowledge in Shell or Python is an advantage.

Good to Have

- Experience with Splunk Enterprise Security (ES) or SIEM environments.
- Splunk Administrator/Power User certification.
- Experience with Splunk Cloud and AWS/Azure/GCP.
- Knowledge of Docker/Kubernetes logging and REST API integrations.

Pay: From ₹60,000.00 per month

Benefits

- Cell phone reimbursement
- Food provided
- Health insurance

Application Question(s):
- Have you administered a production Splunk environment with an indexer cluster (replication factor and search factor configured) and performed upgrades or patching on it?
- Have you configured a Search Head Cluster or a Deployment Server to push apps and configurations to forwarders at scale?
- Have you written props.conf and transforms.conf settings yourself (LINEBREAKER, TIMEPREFIX, TIME_FORMAT, index-time field extraction, or routing and filtering events to different indexes)?
- Have you troubleshot a Universal Forwarder that was running but not delivering data, using splunkd.log, _internal index searches, and outputs.conf/network checks?
- Have you designed index configurations in indexes.conf (hot/warm/cold paths, retention, frozenTimePeriodInSecs, volume sizing) and handled license usage or performance tuning issues such as slow searches or indexing queue blocking?

Work Location: In person

📌 Splunk Admin ( 5 plus years of experience) (Coimbatore)
🏢 Primemover Solutions
📍 Coimbatore