Developing for Splunk Enterprise

Are Splunk consultants and Splunk developers the same? If not, what are the roles and responsibilities for both?


Are both a Splunk consultant and Splunk developer the same? If not, what are the roles and responsibilities of both?

Tags (2)


Throwing my two cents into the ring here. A "consultant" is (typically) someone who is not an employee whom you pay for their expertise in a subject area. From that perspective any hired gun that you bring in to help you with Splunk is a "Splunk Consultant." And, like most other I/T consultancies, Splunk "consultants" have a wide range of skills.

The typical Professional Services consultant is usually deepest in administration / architecture knowledge. That is, they will be experts at installing and configuring Splunk in a variety of scenarios and handling things like onboarding of data and normalization via field extraction and other knowledge objects.

Some consultants, though, have a different skill set like building dashboards and custom visualizations. These lean more heavily on the "development" skill sets (HTML / Javascript / CSS / SplunkJS Apis /etc) than the "administration and architecture" ones.

I don't find trying to put Splunk consultants into a taxonomy to be particularly useful. A good consultant is able to tell you what they are skilled in, and if you need something where they are not completely comfortable they should be able to either lean on their support system to become comfortable or they should admit to you that you need a differently-skilled resource (preferably by name).

One of the things Splunk's Professional Services managers are very good at is matching your requirements to the skills of the resources they have at their disposal.


Hear me now, I beg of you. For only through magic and sorcery can we describe the trumpery of many a scandalous throttlebottom. Consultancy, aye I be one (certifiable of course)! I, one of many on my collection of compatriots, consult and transfer multitudes of knowledge upon those not gifted in the ways, means, and customs of the fair land Splunktopia. We provide services of said kind, such that we improve, correct, mitigate, and investigate all manner of Splunk object and instance alike! Feagueing, not so much, to say the least. We be but one of many a plethora of partners or other like-wise minded individuals. To say we are the professionals is nary a far stretch of truth. But, I also be one of the Developers! Having recently penned the annuals of the "Splunk Developer's Guide", I too am a developer of Splunk relation. Javascript, and Python, and HTML, oh my! For we dive into the world of app abstraction, automation, articulation, and abundance. We code craftily, carefully, and concisely. We strive for perfection but normally obtain only mediocrity.

The definitions are broad and varied, and much depends on the nature of your declaration and curiosity. But, as the clock runs widdershins, I find that most of either Consultancy or Developer can meet the needs of the people of this fair land. And now, I gleefully ride the pony of Buttercup and enjoy the plentitude and inquisitiveness of being a chasmophile!

Splunk Employee
Splunk Employee

alt text

Splunk Employee
Splunk Employee

I'm not quite sure what you're asking. Can you provide some more context for your question, and why you are wondering about it? "Splunk consultants" could refer to Splunk Professional Services, a variety of Splunk partners, or independent consultants who specialize in Splunk software.

"Splunk developers" could be anyone who is building a Splunk app, modular input, customized UI, or other extension to the Splunk platform, using the web framework, SDKs, REST API...lots of things. It could also refer to someone working within the Splunk product development team, building Splunk software directly.

What is your question really about?

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!