- Hands-on experience in design, and implementation of Splunk architecture.
- Experience on Linux and Windows administration
- Able to do data onboarding, fields extraction according to Splunk best practices.
- Able to provide Splunk guide and Splunk operation document
- Able to setup forwarders and onboard new data sources into the environment.
- Able to troubleshoot and identify Splunk issue relating to performance and searches.
- Able to fine-tune Splunk use cases (rule) and optimize searches performance.
- Able to create new dashboard to enhance the visualization of the data and create Splunk use cases for alerts/reports.
- Knowledge on index segregation and user restriction setup
- Knowledge on using Splunk Enterprise Security
- Able to do Common Informational Model for Enterprise Security.
EA Number: 11C4879