Sravan Sagar

Security Managed Services Analyst | Splunk Administrator

Accenture Technology

Nov 2023 - Present

Administer and support enterprise Splunk environments involving Search Heads, Indexers, Heavy Forwarders, Universal Forwarders, and Deployment Server. Install, configure, maintain, and troubleshoot Splunk Enterprise on Linux and Windows servers. Design and implement Splunk platform configurations based on application and business requirements. Support cluster-based Splunk environments, including Search Head Cluster and Indexer Cluster operations. Perform Splunk application installation, configuration, deployment, maintenance, and upgrades. Manage Splunk configuration files including inputs.conf, props.conf, transforms.conf, deployment.conf, and application-level configuration. Perform platform health checks and troubleshoot Splunk service, indexing, search, and data ingestion issues. Analyze internal Splunk logs including splunkd.log, metrics.log, and internal indexes to identify platform and indexing issues. Collaborate with Splunk Support and internal infrastructure teams for complex production issues and platform troubleshooting. Develop and optimize SPL queries for data analysis, monitoring, troubleshooting, reporting, and operational use cases. Create and maintain Splunk dashboards, reports, alerts, saved searches, and lookup-based monitoring solutions. Develop monitoring solutions for application health, system status, job execution, errors, performance, and operational KPIs. Implement threshold-based monitoring and alerting to identify critical, warning, and normal operational conditions. Troubleshoot search and query performance using Job Inspector, execution analysis, and Splunk internal logs. Support dashboard customization and visualization based on business and application monitoring requirements. Develop and support Splunk automation and integration workflows using Python, Bash/Shell scripting, REST APIs, and Splunk capabilities. Implement automation for monitoring, alert processing, data validation, deployment activities, and operational workflows. Integrate Splunk monitoring and alerting workflows with ServiceNow/ITSM processes for incident creation and resolution. Work with HTTP Event Collector (HEC) for application and external data ingestion into Splunk. Support Splunk DB Connect configurations for database connectivity and data onboarding. Troubleshoot end-to-end data flow across source systems, Heavy Forwarders, Indexers, and Search Heads. Support application integrations and monitoring workflows involving SAP systems and enterprise applications. Contribute to Agentic AI and Generative AI automation and integration initiatives within the monitoring and operations environment. Support onboarding and monitoring of SAP application data into Splunk for ABAP, HANA, JAVA, SAP/PIPO, and related application components. Configure and validate SAP data ingestion and monitoring workflows through HEC and other Splunk ingestion mechanisms. Develop dashboards and alerts for SAP operational monitoring and application health. Implement monitoring use cases for batch jobs, application errors, long-running jobs, delayed jobs, system status, and operational metrics. Provide 24x7 production support and troubleshooting for Splunk-based monitoring environments. Analyze incidents, identify root causes, implement fixes, and coordinate with relevant teams for issue resolution. Participate in deployment and change activities across Development, QA, Pre-Production, and Production environments. Work with application, infrastructure, and platform teams to analyze requirements and provide implementation estimates. Coordinate with developers and Splunk Support to troubleshoot platform issues and improve environment performance. Support operational requirements within agreed timelines and participate in production issue resolution.