Responsible to install and configure the Splunk forwarder agent across various OS in Application environment to collect the data feeds into Splunk Environment. Experienced in optimizing the Splunk Forwarder management architecture through a centralized server to manage the configurations. Responsible to create index with appropriate retention and retirement policies by managing the bucket policies. Responsible to implement Splunk Heavy forwarder component to perform intermediate routing, filtering, masking and overriding before the indexing. Experienced in designing and implementing the architecture with Indexer clustering to maintain data availability and disaster recovery. Designed and implemented search head clustering to provide transparency and seamless user GUI experience through horizontal scaling. Expertise in building Standalone Splunk architecture with two indexers in a load-balanced group with a Search head with a capacity to collect data from 300+ forwarders. Expertise in designed and implementing a large distributed architecture with Deployment Server, Heavy forwarder and Clusters. Experience in handling high-end Splunk design with Indexer clustering and Search head clustering. Expertise in Log Analysis and creation of Splunk knowledge objects. Knowledge in Splunk Field Extraction, regular expression based extractions and creation of Eventtypes, Tags and Field Aliases. Created Splunk automatic lookups and workflows. Developed Splunk Dashboards using Simple XML with customizations and Splunk Forms with various inputs options in Simple XML. Scheduled Splunk based Reports and Alerts to monitor the system health performance and breaches. Experience in maintained Splunk based native Role and User creation.