MenuClose

Splunk ITSI and observability · Sydney, Australia

Deepa, Deepashree Vijaykumar

Splunk Consultant at Deploy Partners

hi@deepa.devLinkedIn
Scroll

About

I build Splunk ITSI fault monitoring that turns raw network alarms into the right incident, on its own.

A Splunk consultant and Splunk Core Certified Power User, working on Splunk ITSI correlation searches, notable events and episodes, service models and KPIs, and automated routing to BMC Helix.

I build and fix the searches that carry SNMP traps across large telecommunications networks, and write the design documents that keep them auditable.

Splunk first, and what it connects to.

Fault monitoring

  • Splunk ITSI
  • Correlation searches
  • Notable events and episodes
  • Service models and KPIs
  • BMC Helix / Remedy

Splunk platform

  • SPL
  • Dashboard Studio
  • KV Store and lookups
  • Splunk Connect for SNMP
  • Splunk Enterprise Security

Beyond Splunk

  • AWS
  • New Relic
  • Python
  • Linux
  • REST
  • SIEM

What the work looks like, up close.

Five parts of my work, drawn so you can try them. Scroll through, or click one.

From my work

Fewer, better incidents.

The problem
One network fault can raise hundreds of alarms at once.
What I build
I write the correlation searches that fold them into one episode.
The outcome
One BMC Helix incident, raised on its own.

Splunk ITSI correlation searches, notable events, episodes, Helix routing

  1. 1,240Raw alarms
  2. 36Notable events
  3. 1Episode
  4. 1Helix incident

Open tickets1

  1. Core service degraded, 1,240 alarms grouped

Illustrative numbers, not client data.

From my work

Break something and watch it travel.

The problem
A broken box says little about what the business feels.
What I build
I build service models and KPIs that weight what matters most.
The outcome
You see the impact on the service, not just an alert.

Splunk ITSI service models, KPIs, health scores

  • Mobile networkHealthy100
    • RadioHealthy100
    • CoreHealthy100
    • TransportHealthy100

Illustrative weights and scores. A KPI with importance 11 caps its parent's health.

From my work

A log line gets smarter.

The problem
A raw event says what happened, but not whether it matters.
What I build
I onboard critical data sources and enrich event logs with correlation searches.
The outcome
Threats are spotted sooner, as one notable event with its context.

Cybersecurity monitoring, Splunk Enterprise Security, detection use cases

Before

Failed login for jsmith from 203.0.113.42

After

  • Assetvpn-gw-01, high criticality
  • Identityj.smith, Finance
  • LocationOverseas, a first for this user
  • Threat intelAddress on a known bad list
  • Risk score80 of 100

Notable eventBrute force login on a critical asset. High urgency.

Illustrative event, not client data.

From my work

Messy in, structured out.

The problem
Syslog and SNMP traps arrive as raw, uneven text.
What I build
I onboard them with forwarders and Splunk Connect for SNMP into named fields.
The outcome
One search works across every source.

Field extraction, normalisation, Splunk Connect for SNMP

Raw syslog

Oct 12 03:14:07 edge-rtr-07 LINK-3-DOWN: Interface ge-0/0/1 down

Named fields

time
12 Oct, 03:14:07
host
edge-rtr-07
severity
3, error
event
Link down
interface
ge-0/0/1

From my work

Built to scale across AU/NZ.

The problem
One server cannot take in, keep and search a whole network's data.
What I build
I architected a clustered Splunk environment across AU/NZ, with heavy forwarders and an indexer cluster.
The outcome
Reliable ingestion and fast search, with data copied across nodes.

Forwarders, heavy forwarders, indexer clustering, search heads

  1. Network gear, servers and apps write logs and alarms all day.

  2. Small agents on each source send the data on, and resend anything that does not arrive.

  3. Parses, filters and routes the data before it is stored.

  4. Indexers store the data and copy it across nodes, so nothing is lost if one fails.

Where I have worked, newest first.

  1. to Now1 yr 5 mo

    Splunk Consultant

    Deploy Partners

    Sydney, Australia

    • Designed the Splunk ITSI correlation searches that turn a telco's SNMP traps into BMC Helix incidents.
    • Built the service models, KPIs and KV store lookups behind fault correlation, and fixed auto-ticketing defects.
    • Moved Elastic dashboards and fault alerting into Splunk, and became the go-to for search logic.

  2. to 4 mo

    Intern

    Innovadeas Pty Ltd

    Sydney, Australia

    • Successfully deployed and integrated AI agents utilizing various models from Hugging Face, gaining hands-on experience with real-world applications.
    • Gained experience in applying LLMs to specific tasks and projects, expanding practical knowledge beyond theoretical concepts.
    • Automated test execution using Selenium and Playwright with TypeScript, and maintained regression test cases.
    • Coordinated with developers and business analysts to improve software testing processes.

  3. to 2 yrs 5 mo

    Administrator

    Bonfect Snackfood Service

    Sydney, Australia

    • Ran day-to-day administration of the Amazon Vendor Central account, keeping operations smooth and customers well looked after.
    • Maintained the inventory database that tracked stock availability and informed decisions.
    • Worked with Amazon Vendor Central management to resolve issues and plan for sales growth.

  4. to 1 yr 11 mo

    Systems Engineer

    Cerner Corporation

    India

    • Oversaw large-scale infrastructure of more than 500 servers.
    • Built Splunk dashboards and proactive alerting that gave the whole estate operational visibility.
    • Installed and managed Splunk forwarders across Linux and Windows for log management.

Certifications and training.

    1. 01Splunk · SPLK-1002

      Splunk Core Certified Power User

    2. 02Splunk · SPLK-1001

      Splunk Core Certified User

    3. 03Splunk · Legacy

      Splunk IT Service Intelligence Certified Admin

    1. 04AWS

      Cloud Practitioner Essentials

    2. 05New Relic

      Observability Practitioner

    3. 06UTS

      Women in Engineering and IT

Merge the stack.

Two matching tools merge into the next one up. Keep the pile under the line.

Paused

Round over.

Score
0
Best
0

How to play

  • Mouse: aim, click to drop.
  • Touch: drag to aim, let go to drop.
  • Keys: arrows to aim, Space to drop.

The ladder

  1. Linux
  2. Python
  3. REST
  4. AWS
  5. New Relic
  6. SPL
  7. Dashboard Studio
  8. KV Store and lookups
  9. Correlation searches
  10. Splunk ITSI
  11. Deepa

Only the first five drop in. The last one is me.

Say hi.

hi@deepa.dev
LinkedIn

Based in Sydney, Australia