Mid-Level Splunk Analyst (Migration Specialist)

Thank you for considering IT Concepts dba Kentro, where innovation drives opportunity and collaboration leads to success. Our dynamic community of experts is fully committed to advancing our customers' missions, fostering professional growth, and making a positive impact on our communities.                                               

By joining our supportive community, you will find that Kentro is dedicated to your personal and professional development. Together, we can drive meaningful change, spark innovation, and achieve extraordinary milestones.

Kentro is seeking a dedicated Mid-Level Splunk Analyst to support a high-profile migration effort for a major financial institution. This role focuses on the technical execution of migrating observability workloads from Splunk Observability Cloud (SOC) to Observe Inc.

The ideal candidate is a proficient Splunk practitioner who is eager to expand their skillset. While deep expertise in Observe is not required on day one, you must be willing to receive training in Observe and quickly apply that knowledge to translate complex queries and optimize data environments. You will work alongside IT architects and stakeholders to ensure seamless data transfer, query translation (SPL to OPAL), and post-migration optimization in a 24/7 operational environment.

Responsibilities:

Migration Execution & Query Translation:

• Execute the inventorying of dashboards and saved searches via SOC REST APIs to prepare for migration.

• Manually translate Splunk (SPL) queries into Observe (OPAL) with high semantic fidelity, ensuring critical financial logic (e.g., fraud detection filters) is preserved.

• Strict Adherence to Security and Standards: Perform all code translations and query logic updates manually or via approved scripts; the use of AI tools (e.g., O11y GPT) is strictly prohibited for this project due to security and accuracy requirements.

Data Ingestion & Pipeline Configuration:

• Assist in configuring data ingestion pipelines using OpenTelemetry agents and intermediaries like Cribl or Fluent Bit.

• Map data models to Observe’s Snowflake-backed data lake and implement sampling strategies (e.g., 10-20% for traces) during testing phases.

Validation & Monitoring:

• Rebuild and validate dashboards in the Observe UI/API for real-time monitoring.

• Conduct parallel query comparisons and replay scripts to validate data accuracy between the legacy Splunk environment and the new Observe environment.

• Monitor ingestion health and anomaly detection post-migration to ensure user adoption and reduce alert fatigue.

Documentation & Process Improvement:

• Maintain rigorous Git-versioned documentation of all migration scripts, configurations, and rollback plans.

• Participate in retrospectives to refine processes for financial audits and scalability.

Location: This position can be performed remotely within the United States and will support Eastern Time working hours.