topic Re: Upskilling suggestion in Splunk Enterprise

Upskilling suggestion

splunklearner — Mon, 10 Mar 2025 03:51:19 GMT

As of now I am working in Splunk since 3 years. I am well versed with development and recently started working on admin part. I am still learning. I don't have any knowledge on other tools or languages apart from Splunk. This project has requirement of AWS (our splunk instances hosted on AWS cloud). So started learning AWS. Here my doubt is along with Splunk, what tool or software can I upskill myself to get more opportunities in future?

I have these thoughts... Not sure I am right..

1. Is it good to learn DevOps because already started AWS?
2. cybersecurity and SIEM
3. SRE

I have zero knowledge on coding till date. Please suggest me good path where I can upskill myself may be in next 1 yr.

Re: Upskilling suggestion

livehybrid — Mon, 10 Mar 2025 06:52:31 GMT

Hi @splunklearner

With your 3 years of Splunk experience and your new learning in AWS, you have several promising career paths to consider. Here's my take on your options, although please remember that the job market in your area may have a stronger requirement for certain skills than others - have you had a look for the kind of job you want to be doing in a year to see what skills are required?

Cybersecurity and SIEM

This is perhaps the most natural extension of your current Splunk skills. Since you already understand SIEM concepts through Splunk, deepening your security knowledge would leverage your existing expertise.

Recommended path:

Get a security certification like Security+ or SSCP as a foundation
Follow with a Splunk security certification (Splunk Enterprise Security Certified Admin)
Learn about threat hunting and incident response workflows
Study security frameworks like MITRE ATT&CK

Time investment: 6-9 months for meaningful progress

DevOps with Splunk Focus

Since you've started learning AWS, building DevOps skills makes sense. Splunk is often a critical monitoring component in DevOps pipelines.

Recommended path:

Complete AWS Solutions Architect Associate certification
Learn Infrastructure as Code (Terraform is more accessible for non-coders)
Study CI/CD concepts (Jenkins, GitLab CI)
Learn Docker fundamentals and basic Kubernetes concepts
Focus on Splunk's role in DevOps monitoring and observability

Time investment: 9-12 months

SRE (Site Reliability Engineering)

SRE combines aspects of systems engineering and operations, with Splunk being a valuable tool for monitoring and alerting.

Recommended path:

Strengthen your Linux skills
Learn basic scripting with Python (start small - this is learnable!)
Focus on monitoring architectures and alert design
Study incident management and postmortem processes
Learn about SLIs, SLOs, and SLAs

Time investment: 12+ months (involves more coding skills)

What would I do?

Given your background and the 1-year timeframe, I recommend focusing on Cybersecurity and SIEM while gradually adding some DevOps skills.

Why? Your Splunk experience gives you a head start in security, and the demand for security professionals with SIEM expertise remains high. The AWS knowledge you're building naturally complements this, as cloud security is a critical concern.

For someone without coding experience, security offers more entry points that don't immediately require programming skills, though I'd suggest learning basic Python automation as you progress.

Good luck with your future learning! Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Upskilling suggestion

ITWhisperer — Mon, 10 Mar 2025 12:34:45 GMT

SRE and DevOps are organisational / cultural paradigms which require buy-in at multiple levels in an organisation; Security does too to some extent but that is easier to "sell", and would probably give shorter term benefits to your career.

Having said that, you could look at the Splunk article on SRE and Golden Signals (https://www.splunk.com/en_us/blog/learn/sre-metrics-four-golden-signals-of-monitoring.html?locale=en_us) and even start building dashboards and alerts to represent these signals in your existing environment to help promote the concepts and value of SRE. Ideally, you need to find an Executive Sponsor for SRE (and indeed DevOps) otherwise it can get rather frustrating!