Splunk Administration with ITSI

Role Purpose

The purpose of the role is to create exceptional architectural solution design and thought leadership and enable delivery teams to provide exceptional client engagement and satisfaction.

Position: Splunk Administrator (Enterprise Observability Platform Operations)

Location: Anywhere in India

Role Summary:

We are seeking a Splunk Administrator to support daytoday operations of the Enterprise Observability- Splunk suite platform (Splunk Enterprise ITSI and Splunk Observability Cloud) including data onboarding system maintenance monitoring troubleshooting and user support.

This is a handson Splunk support operations role supporting a missioncritical environment that requires handson collaboration with engineering operations and application teams.

Key Responsibilities

Platform Administration & Daily Operations

• Monitor Splunk Enterprise platform health performance and capacity.
• Perform routine administrative tasks: restarts configuration updates index management and license monitoring.
• Support search head and indexer cluster operations under guidance from senior engineers.
• Maintain forwarder configurations and ensure reliable data ingestion.

Data Onboarding & Configuration

• Onboard new data sources using forwarders APIs addons and cloud integrations.
• Configure inputs props/transforms sourcetypes and parsing rules.
• Validate data quality field extractions and CIM compliance.
• Maintain and update Technology AddOns (TAs) as needed.

ITSI & Observability Support

• Assist with ITSI KPI updates service model maintenance and correlation search tuning.
• Support troubleshooting of ITSI lag KPI failures and service health issues.
• Help maintain integrations with Splunk Observability Cloud (O11y) and OpenTelemetry collectors.

User Support & Operational Requests

• Provide support to internal users for searches dashboards alerts and knowledge objects.
• Assist teams with troubleshooting search performance and data visibility issues.
• Maintain documentation runbooks and onboarding guides.

Incident & Problem Management

• Participate in incident response for Splunkrelated issues.
• Investigate ingestion failures search errors and platform alerts.
• Support root cause analysis and implement corrective actions.

Governance & Best Practices

• Follow established standards for data onboarding index naming retention and tagging.
• Ensure compliance with security audit and logging requirements.
• Maintain accurate documentation of configurations and operational procedures.