• Normalize data to fit the CIM using field alias and regex expressions, enabling data model acceleration and increasing search time performance.• Developed custom TA’s; Tailoring data inputs, parsing, indexes, KOs, and security standards to conform to diverse client requirements.• Utilize various on-boarding methods such as HEC, REST API, DB Connect, TCP/UDP etc to securely collect, parse, and index data from multiple sources via on-prem or cloud.• Implement data filtering and deduplication configs in Cribl before ingesting to Splunk, reducing daily license quota by 10%, resulting in cost savings and improved system performance.• Manage, optimize, and troubleshoot the clustered environment, maintaining healthy components and high availability.• Utilize the deployment server to distribute apps to internal/client server classes and push config updates to over 1500 forwarders, automating repetitive task and promoting organization.• Wrote complex SPL queries to analyze client datasets and generate daily/weekly dashboard reports, providing insights to make appropriate decisions.• Built custom macros to compress common search queries related to client data, reducing manual input errors and increasing productivity.• Configured alerts to monitor key metrics and logs such as CPU usage, memory utilization, and search head/indexer cluster status, ensuring early detection of performance degradation and system failures.

• Configured Heavy Forwarders to efficiently collect and push large volumes of data from various sources to indexers, implementing client based parsing configs that pre-organize the datasets before indexing.• Coordinated with admins to specify and manage user roles, ensuring appropriate access to indexes, KOs, and apps.• Ran daily health checks using the Monitoring Console; Resolved deployment issues including search head cluster failures and indexer replication issues, ensuring high availability and healthy components.• Assisted in building correlation searches and adaptive response actions to detect and respond to security threats, reducing incident response times by 5%.• Developed custom TAs to align with CIM standards and conventions, ensuring compatibility with existing deployments.• Enhanced data security and compliance by leveraging props/transforms masking configurations to protect PII data when on-boarding.• Managed index retention policies based on compliance requirements and business needs, and leveraging bucket management to optimize storage usage.

• Created and configured management reports and dashboards for client application log monitoring.• Assisted in restructuring complex saved searches to reduce processing time and improve response rates, resulting in faster access to critical data and insights.• Utilized the Linux Btool command to manage and troubleshoot conf file precedence, ensuring global configurations don’t overwrite pre-existing app configs distributed by the deployment server.• Collaborated in implementing disaster recovery policies for deployments to minimize downtime and data loss.• Wrote advanced SPL queries for data manipulation and aggregation, providing clients with dashboards that highlight trend analysis for decision making.• Installed and implemented Splunk software on new local machines through Linux and Windows systems.