Senior Splunk Data Administrator - 6-Month Contract, Hybrid

Whizdom; Melbourne; Hybrid; AUD 90,000 - 130,000; Full time

Job summary

Whizdom is seeking an experienced Splunk Data Administrator to support data onboarding, normalisation and quality in a hybrid Splunk environment. The contract role ensures log sources are onboarded, parsed, normalised and available for security operations, IT dashboards, and reporting.

Key responsibilities include end-to-end onboarding, CIM alignment, field extractions, and management of Splunk Add-ons across on-prem and cloud deployments, with a focus on data governance and SPL validation.

Qualifications

• 5–10 years of Splunk administration, data onboarding or equivalent experience.
• Knowledge of CIM normalization, data models, tags and event types.
• Experience with regex, JSON and key-value field extraction.
• Advanced knowledge of props.conf, transforms.conf, sourcetypes and timestamp configuration.
• Experience deploying and managing Splunk Add-ons across multiple Splunk tiers.
• Experience supporting indexer clusters, search head clusters, forwarders and deployment servers.
• Understanding of hybrid Splunk architecture and cloud-based ingestion patterns.
• Ability to write and validate SPL for data quality and CIM compliance.
• Knowledge of security, infrastructure and cloud log sources.

Responsibilities

• Lead end-to-end onboarding of new log sources including requirements gathering, parsing and release.
• Align data sources with the Splunk Common Information Model.
• Develop and maintain field extractions using regex, props.conf and transforms.conf.
• Configure sourcetypes, timestamps, line breaking and structured data parsing.
• Install, configure and deploy Splunk Technology Add-ons across forwarders, indexers and search heads.
• Support hybrid Splunk environments with on-premises and cloud infrastructure.
• Configure and troubleshoot ingestion via Syslog, HEC, APIs, file monitoring and Windows Event Logs.
• Monitor pipeline performance, indexing delays, forwarder health and data quality.
• Maintain governance across indexes, sourcetypes, retention and access controls.
• Develop operational documentation, runbooks and onboarding standards.

Skills

Splunk admin experience

CIM normalization

Regex

SPL queries

Cloud and on-prem knowledge

Tools

Splunk Add-ons

props.conf

transforms.conf

HEC

Job description

Whizdom is seeking an experienced Splunk Data Administrator to support data onboarding, normalisation and quality in a hybrid Splunk environment. The contract role ensures log sources are onboarded, parsed, normalised and available for security operations, IT dashboards, and reporting.

Key responsibilities include end-to-end onboarding, CIM alignment, field extractions, and management of Splunk Add-ons across on-prem and cloud deployments, with a focus on data governance and SPL validation.