Job DescriptionWe're looking for a hands-on Cribl Consultant to enable our Cribl platform and onboard Splunk data sources through Cribl Stream. You'll build data pipelines that filter, shape and route data to Splunk, improving data quality and reducing ingest volume and cost.
Responsibilities- Set up and configure the Cribl Stream platform: Leader, Worker Groups, Sources, Destinations, Routes and Pipelines.
- Onboard Splunk data sources through Cribl Stream, including traffic from Splunk Universal Forwarders and Heavy Forwarders (Splunk-to-Splunk and HEC).
- Build and maintain data pipelines using Cribl functions for filtering, parsing, masking, sampling, enrichment and aggregation.
- Stream data from Cribl to Splunk indexers and Splunk Cloud, keeping sourcetype, index and field alignment intact.
- Reduce data volume by dropping low-value events and fields, and measure the ingest and license savings.
- Validate data before and after onboarding so it arrives complete and in the right format in Splunk.
- Monitor Cribl health and throughput, and troubleshoot data flow issues across Cribl and Splunk.
- Document pipelines, routing logic and onboarding standards, and support knowledge transfer to internal teams.
Requirements- 3-5+ years in data engineering, observability or log management.
- Hands-on experience with Cribl Stream: Sources, Destinations, Routes, Pipelines and Packs.
- Cribl certification (such as Cribl Certified Observability Engineer or Cribl Stream Admin).
- Experience building data filtering and data pipelines for log and event data.
- Working knowledge of Splunk architecture, especially the Universal Forwarder (UF), Heavy Forwarder (HF) and indexer, and how data flows between them.
- Familiarity with Splunk sourcetypes, indexes, and props.conf and transforms.conf.
- Understanding of data formats and parsing: JSON, syslog, key-value and regex.
- Scripting in JavaScript, Python or Bash.
Nice to have (Will be an advantage)- Experience with Cribl Edge, Cribl Lake or Cribl Search.
- Experience with cloud data sources (AWS CloudTrail, CloudWatch, S3).
- Experience with Splunk Cloud or Splunk-to-Cloud migrations.
- Splunk certification (such as Splunk Enterprise Certified Admin).
