[HelloNurse]

I recommend avoiding a role of "Splunk Engineer", particularly in the long term, mainly because it's a narrow role that is likely to become intolerably boring and limited quickly.

While Splunk is rather good, I don't think there is enough depth and value in being a Splunk expert to sustain a whole career (like being an expert of SAP or C++ or some popular DBMS).

CTI is one of the good uses you can apply Splunk and many more tools and methods to; if you want to be a CTI expert you should transcend your current Splunk focus, or you'll be the "hero" who keeps Splunk running despite budget problems and maintains the data sources and dashboards that someone actually important asks for.