Cribl Observability Consultant (Cribl Stream Engineer) - US Citizen or Green Card Only

Nextiya LLC; Charlotte (NC); On-site; USD 120,000 - 170,000; Full time

Job summary

Nextiya LLC in Charlotte, NC seeks a hands-on Cribl Observability Consultant (Cribl Stream Engineer) to enable our Cribl platform and onboard Splunk data sources through Cribl Stream. You will build data pipelines that filter, shape and route data to Splunk, improving data quality and reducing ingest volume and cost.

Responsibilities include setting up Cribl Stream components, onboarding Splunk sources, building pipelines with Cribl functions, and monitoring health.

Qualifications

• 3–5+ years in data engineering, observability or log management.
• Hands-on experience with Cribl Stream: Sources, Destinations, Routes, Pipelines and Packs.
• Cribl certification (such as Cribl Certified Observability Engineer or Cribl Stream Admin).
• Experience building data filtering and data pipelines for log and event data.
• Working knowledge of Splunk architecture, UF/HF/indexer and data flow between them.
• Familiarity with Splunk sourcetypes, indexes, and props.conf and transforms.conf.
• Understanding of data formats and parsing: JSON, syslog, key-value and regex.

Responsibilities

• Set up and configure the Cribl Stream platform: Leader, Worker Groups, Sources, Destinations, Routes and Pipelines.
• Onboard Splunk data sources through Cribl Stream, including traffic from Splunk Universal Forwarders and Heavy Forwarders (Splunk-to-Splunk and HEC).
• Build and maintain data pipelines using Cribl functions for filtering, parsing, masking, sampling, enrichment and aggregation.
• Stream data from Cribl to Splunk indexers and Splunk Cloud, keeping sourcetype, index and field alignment intact.
• Reduce data volume by dropping low-value events and fields, and measure the ingest and license savings.
• Validate data before and after onboarding so it arrives complete and in the right format in Splunk.
• Monitor Cribl health and throughput, and troubleshoot data flow issues across Cribl and Splunk.
• Document pipelines, routing logic and onboarding standards, and support knowledge transfer to internal teams.

Skills

Data engineering

Observability

Log management

Data pipelines

Quality data validation

Tools

Cribl Stream

Splunk

Cribl Edge

Job description

Cribl Observability Consultant (Cribl Stream Engineer) - US Citizen or Green Card Only

Charlotte, United States | Posted on 10/03/2026

We're looking for a hands-on Cribl Consultant to enable our Cribl platform and onboard Splunk data sources through Cribl Stream. You'll build data pipelines that filter, shape and route data to Splunk, improving data quality and reducing ingest volume and cost.

Responsibilities

Set up and configure the Cribl Stream platform: Leader, Worker Groups, Sources, Destinations, Routes and Pipelines.

Onboard Splunk data sources through Cribl Stream, including traffic from Splunk Universal Forwarders and Heavy Forwarders (Splunk-to-Splunk and HEC).

Build and maintain data pipelines using Cribl functions for filtering, parsing, masking, sampling, enrichment and aggregation.

Stream data from Cribl to Splunk indexers and Splunk Cloud, keeping sourcetype, index and field alignment intact.

Reduce data volume by dropping low-value events and fields, and measure the ingest and license savings.

Validate data before and after onboarding so it arrives complete and in the right format in Splunk.

Monitor Cribl health and throughput, and troubleshoot data flow issues across Cribl and Splunk.

Document pipelines, routing logic and onboarding standards, and support knowledge transfer to internal teams.

Requirements

3–5+ years in data engineering, observability or log management.

Hands-on experience with Cribl Stream: Sources, Destinations, Routes, Pipelines and Packs.

Cribl certification (such as Cribl Certified Observability Engineer or Cribl Stream Admin).

Experience building data filtering and data pipelines for log and event data.

Working knowledge of Splunk architecture , especially the Universal Forwarder (UF), Heavy Forwarder (HF) and indexer, and how data flows between them.

Familiarity with Splunk sourcetypes, indexes, and props.conf and transforms.conf.

Understanding of data formats and parsing: JSON, syslog, key-value and regex.

Nice to have (Will be an advantage)

Experience with Cribl Edge, Cribl Lake or Cribl Search.

Experience with cloud data sources (AWS CloudTrail, CloudWatch, S3).

Experience with Splunk Cloud or Splunk-to-Cloud migrations.

Splunk certification (such as Splunk Enterprise Certified Admin).