[igotroot]

Thanks for your reply HelloNurse,

If I'm understanding you correctly and reading a bit between the lines, you'd recommend a move toward either a new product (within the same space?) or take a bigger drink of the Splunk kool-aid and move on to architecture.

I noticed you didn't mention CTI at all. I ass-ume that you're recommending the Splunk Engineer side more (they can also get into architecture, so that fits your description)?

[HelloNurse]

I recommend avoiding a role of "Splunk Engineer", particularly in the long term, mainly because it's a narrow role that is likely to become intolerably boring and limited quickly.

While Splunk is rather good, I don't think there is enough depth and value in being a Splunk expert to sustain a whole career (like being an expert of SAP or C++ or some popular DBMS).

CTI is one of the good uses you can apply Splunk and many more tools and methods to; if you want to be a CTI expert you should transcend your current Splunk focus, or you'll be the "hero" who keeps Splunk running despite budget problems and maintains the data sources and dashboards that someone actually important asks for.