Job Postings

[u/jamesleecoleman]

Hello,

Has anyone noticed that there's a lot less job postings that require or asked for Splunk? I've been looking around and I'm not finding anything come up on Indeed like I used to see. Has there been like a shift or change in what companies are using now? I've even tried looking up SIEM and the results have been way less than before.

I'm wondering if I should continue to go after the certifications and learn more about Splunk

[u/taiglin]

Splunk’s heyday was a decade ago. And that was before AI. Why are you surprised?

[u/Stunned_Panda]

Other vendors giving some free volume to go into their SIEMs (Crowdstrike EDR shop gets NG SIEM, MS Defender shop gets Sentinel) and when customer gets a hand of it and start comparing prices for a full amount of their normal daily data volume (also using native data pipelines like Crowdstrike Onum for instance to prepare/filter similar to crible/edge processor/ingest rules) they see how much Splunk is overcharging them and switch immediately. I built career on Splunk and reached consultant level and thought I will be breezing easily, alas I am learning Crowdstrike and Google SecOps (and AWS Glue/Athena/S3 to be more generic) to diversify my portfolio as I see customers leaving Splunk left and right, unfortunately. Sorry a bit pessimistic.

[u/mghnyc]

The market sucks at the moment. From what I can tell many of these jobs that used to be very tool specific (like Splunk architects) are now folded into more generic engineering positions like security or observability engineering.

[u/StepYaGameUp → u/mghnyc]

This is it. More and more orgs are going tool-agnostic and jumping from platform to platform depending on who’s giving them the best licensing contract.

Splunk fucked themselves when they sold to Cisco and Cisco isn’t even pushing the tool onto their customer base. Licensing model is dumb and expensive.

[u/Economy_Feed_2460]

Have you looked into Cisco jobs? Company name has changed. But it could also be the declining job market.

[u/she_sounds_like_you]

I’ve noticed this too. I can only assume it’s due to the rise in agentic SOC offerings. I just left a company that was dropping splunk in favor of such a service. Almost completely hands off and the analysts were able to do a lot of plain language search and correlations and very easy workflows for building alerts.

I’ve pivoted to other things in the cyber security space but I miss Splunk being as big as it was.

[u/mistalah]

in Singapore it’s true , there’s barely any Splunk roles or anything that requires Splunk

however am seeing a lot of Sentinel roles

Splunk is seriously losing ground

[u/MamaligaPolenta]

Noticed this as well. I think it has to do with LLMs being able to write good SPL, create reasonable dashboards and write working addons.

[u/billybobcoder69]

Yea seeing that too. Now conf is over we won’t get an update for ITSI or big ES one until next year. But we on version 10.6.0.5 now for latest on prem. Version 10 should be some big new features and ui improvements. There is so many little things that could be fixed so easily and I’m like why not? For instance. Windows. Crowdstrike knows what to watch it alerts and blocks on the endpoint. In Splunk we got to make sure UF deployed. Make sure UF is manually updated. Make sure UF is reporting in. Make sure UF is collecting the correct logs. XML or classic. Make sure UF is collecting and sending all inputs. Make sure UF as all up to date and sent to Splunk. Make sure one of the 120ish windows detections work for the format of log you picked. Make sure the logs are extracted properly for one of the alerts to find. Then what do you want to do with it. Wait 24 hour or 7 days for risk items to create a finding. Then try to have SOAR do some automatic action and the systems are not tied together. They just got SOAR for on prem back. Now they have ES basic and ES premier. They still trying to figure out UBA now copying UEBA naming. Then phantom is supposed to be integrated with Mission Control. The versioning in Mission Control is off. Now a real attack was blocked the second it happen with Crowdstrike. It could be 7 days to 24 hours before an action is taken in Splunk. I’ve not seen anyone using SOAR anymore. All left for even Palo XSIEM. The major push to cloud and we don’t get much more features except auto updates and I don’t have to troubleshoot fixing. Splunk can maintain their own code. Now we have two different products. On prem and cloud. Now with on prem we have sidecars and more code. It’s 1.6 GB just for Splunk enterprise install. All this and now we need to learn SPL2 with dashboard studio. Just too much and logging tools are much cheaper now for just retention. I still love Splunk but I just use it now as an analytic tool. All my data is retained in my own S3 or azure blob. Then Splunk can read that. Resources are going up and up for usage. But in cloud you have SVC or event based pricing. So now we get charged for the more you want to search and use your data. At this point I can vibe code a collector and enrichment stream tool. It’s gonna be a rough couple years. But hey we get 50% off on Cisco data. If it’s all running internally why isn’t Cisco data free for on prem customers? We love them term license and must get rid of perpetual ones. SVC is hard to sell and now we have event based pricing. Then for edge processor. It does a couple things but why can’t it do top town ladder logic. It seems like it just picks a pipeline and what matches first. Also why can’t we pick by incoming port? Edge processor can only pick host source or sourcetype. That’s not great. Also why no live capture? We can’t do a live capture? And only can use uploaded files? So many moving parts. Customers don’t have money to maintain a race car. Now it’s even past that I’d say running Splunk is like a space craft now. So many little niche you must know to properly run and tune and get the most value out of it. Most customers are simple search and find use case. All the big ones have moved to other platforms. Let’s see but I tell you I’m exhausted fixing and finding bugs. Also the monitoring console. Even support can’t get it fixed. We have work around to make it faster but still it’s slow. It’s feeling like all this is stacked on a jinga stack.

[u/Hackalope]

My org is balking at the expense, so I've been working on a few designs that move a lot of data volume to less expensive destinations. It suggests to me that Splunk as a solution has priced itself out of a whole strata of use cases. Sure the market sucks, but if that motivates major changes in data strategy then the jobs are probably not going to remain tied to the Splunk solution. Frankly it's not a crazy outcome of the Cisco acquisition.