[HelloNurse]

You seem divided between becoming more involved with security, continuing as a Splunk expert, and becoming a "product guy".

Choosing between these and other career directions is mostly a matter of finding a specific good job in a specific good workplace.

My impression about Splunk (as a casual user who consults logs to debug application errors) is that if you are already managing data sources and creating dashboards you don't have much left to learn about Splunk: the logical step forward, depending on how senior you are, is either (instead of wasting time with more Splunk) switching to something else to learn a lot about some other important product (not to mention different people, culture, projects etc. in another job) or climbing one step in the architecture ladder and becoming the engineer who plans Splunk deployments and chooses between it and competing and complementary products.

[igotroot]

Thanks for your reply HelloNurse,

If I'm understanding you correctly and reading a bit between the lines, you'd recommend a move toward either a new product (within the same space?) or take a bigger drink of the Splunk kool-aid and move on to architecture.

I noticed you didn't mention CTI at all. I ass-ume that you're recommending the Splunk Engineer side more (they can also get into architecture, so that fits your description)?

[HelloNurse]

I recommend avoiding a role of "Splunk Engineer", particularly in the long term, mainly because it's a narrow role that is likely to become intolerably boring and limited quickly.

While Splunk is rather good, I don't think there is enough depth and value in being a Splunk expert to sustain a whole career (like being an expert of SAP or C++ or some popular DBMS).

CTI is one of the good uses you can apply Splunk and many more tools and methods to; if you want to be a CTI expert you should transcend your current Splunk focus, or you'll be the "hero" who keeps Splunk running despite budget problems and maintains the data sources and dashboards that someone actually important asks for.