Hema Latha

I have 10+ years of experience in Information Technology with 8+ years of experience in implementing, configuring, and supporting Splunk infrastructure across Windows, Linux, Solaris and macOS environments. Expert knowledge of Splunk Enterprise 8.x, 9.x, 10.x, Splunk Enterprise Security 6.x, 7.x, 8.x, Splunk Cloud 8.x, 9.x, 10.x, Splunk IT Service Intelligence 4.x, AppDynamics, Open telemetry (OTEL), Cribl Stream, Zenoss, Prometheus, and Grafana. Extensive experience with Splunk architecture and components, operational intelligence, indexer and search head clusters, SPL queries and dashboards, authentication management, configuration standards, knowledge objects, and IT Service Intelligence.

Strong background in DHS CDM programs and federal cybersecurity standards with Zero Trust architecture knowledge and SOAR playbook design experience.

Splunk Engineer/Developer - Noblis, Inc. - Reston, VA

(2021-02)

Provided technical support and engineering for enterprise Splunk instances handling historic and continuous daily extracts for TIGTA and complex federal log distributions. Worked as a Splunk Engineer/Developer for the IRS CyberDash WorkStream which involves SWAM, Patch, RBD, POAMs, HPNA, Cyber Readiness, CSM, Qualys, Qmulos & CDM Applications. Participated in design and implementation team efforts using Splunk to develop proof of concept where legacy information systems are being migrated to Splunk Enterprise.

Responsible for agile workflow, process, and scrum updates using IBM RTC. Collaborated with multiple teams in a remote environment.

• Provided Technical support for TIGTA backfill of Historic extracts & ongoing daily extracts.
• Created Dashboards, Scheduled reports for Missed Frequency reports, Event counts, TIGTA Host Index Time Gap and IDRS Name Match Report.
• Identified and list log entries where there is a time synchronization issue, specifically hosts that have a significant time gap between _time and _ingest time anything greater than 2 min.
• Research adding host based and threshold-based summaries to the Missed Frequency Report.
• Identify discrepancies in the daily TIGTA process between the extract file and the validation search.
• Ran Ad hoc searches to create historic data in Summary Index.
• Created MFR Report for IDRS audit data based on log files and a panel to account for IDRS child applications.
• Created an executive Dashboard based on the MFR.
• Review audit list of 319 applications (linked) for stoppage and identify gaps in the MFR reporting.
• Splunk application and dashboard development using complex data searches, Splunk SPL, Regex and custom scripting.
• Manage Splunk knowledge objects (Apps, Dashboards, Data Models, Saved Searches, Scheduled Searches, Alerts, Lookups, etc.)
• Responsible for working with stakeholders to troubleshoot issues with Splunk. Responsible for Installation, Scaling, Support, and Troubleshooting Splunk Applications.
• Data onboarding, Splunk TAs, configuration, parsing large data sets and Develop Complex Searches to satisfy customer requirements.
• Responsible for maintaining Splunk Content, Lookup tables, Correlation searches, Alerts, scheduled searches etc.
• Responsible for writing custom regex and scripting.
• Responsible for alerting and reporting metric to the Operational teams so they could reduce outage times.
• Expertise in Splunk SPL as well as python and several other languages.
• Helped develop the QA process for all Splunk content developer teams.
• Experience with DHS's Continuous Diagnostics and Mitigation Program
• Experience writing Splunk Technical Add-ons.
• Provided expertise, best practice, and administrative deliverables to Splunk users and customers.
• Performed tasks such as data on-boarding/ingestion, break/fix troubleshooting, index optimization, searching/visualization, cluster administration, App/Add-on(TA) configuration, and more.
• Used regular expressions to create key-value pairs at search time, ensuring a clean and usable search experience.
• Processed and transformed data sets into competitive advantages using Splunk dashboards.

Splunk Engineer - PHEAA - Harrisburg, PA

(2018-02 - 2021-01)

• Provide regular support guidance to Splunk project teams on complex solutions and issue resolution. Involved as a Splunk Admin in capturing, analyzing, and monitoring front end and middle ware applications.
• As part of SIEM, monitored notable events through Splunk Enterprise Security (Using V5.0). Expertise with Splunk UI/GUI development and operations roles.
• Worked on the Configuration and Installation of the Splunk monitoring and analytics solution for IT Service Intelligence (ITSI). Developed ITSI glass tables, service trees, Entity design, KPIs, correlation searches and notable event aggregation policies.
• Integrated real-time data between Splunk Enterprise and databases by using DB connect app. Created many of the proof-of-concept dashboards for IT operations, and service owners which are used to monitor application and server health.
• Help team on-board data, create various knowledge objects, install, and maintain the Splunk Apps, TAs, and good knowledge on JavaScript for advance UI as well Python for advance backend integrations. Generated Shell Scripts to install Splunk Forwarders on all servers and configure with common Configuration Files such as Bootstrap scripts Outputs. conf and Inputs. conf files.
• On-board new log sources with log analysis and parsing to enable SIEM correlation. Configuration of Inputs. conf and outputs. conf to pull the XML based events to Splunk cloud indexer. Parsing, Indexing, searching concepts Hot, Warm, Cold, frozen bucketing and Splunk clustering. Setup and configuration of search head cluster with three search head nodes and managing the search head cluster with deployer.
• Involved in standardizing Splunk forwarder deployment, configuration and maintenance across Linux and Windows platforms.
• Worked on setting up Splunk to capture and analyze data from various layers, Load Balancers, Web servers and application servers. I have an incredibly good understanding of software development life cycle (SDLC) process, Followed Agile scrum, and story maps for dev tracking.
• Supporting and monitoring Splunk cluster infrastructure in AWS cloud environment. Scripted SQL Queries in accordance with Splunk. Created many of the proof-of-concept dashboards for IT operations, and service owners which are used to monitor applications and server health.
• Various types of charts alert settings Knowledge of app creation, user, and role access permissions. Creating and managing apps, create users, roles, and permissions to knowledge objects. Knowledge about Splunk architecture and various components (indexer, forwarder, search head, deployment server), Heavy and Universal forwarder, License model.
• Created Dashboards, Data models, report, scheduled searches, and alerts. Field Extraction, Using IFX, Rex, Sed Command and Regex in configuration files. Automated reports and alerts to monitor the applications, tools, and services proactively. Configuring and setup different hosts boxes on Ops view and site scope with hashtags. Proactively monitoring and trouble shoot the different hosts boxes on Ops v