Splunk · Primly Community

Went through the full Splunk loop last month. Here's what actually mattered.

backend_bekah · 4 replies

Just wrapped up a Splunk SWE interview for a backend role on their Search team. 5 rounds over two days, all virtual. Here's the breakdown:

Round 1: Recruiter screen. Standard 30 min, mostly about why Splunk, comp expectations, timeline. She was fine.

Round 2: Technical screen with a senior eng. One medium Leetcode problem (sliding window variant), then we talked architecture for 20 min. She kept asking "what would break at scale" which I think was the real signal.

Round 3 (onsite day 1): Full coding. Two problems in 75 min. One was basically a graph traversal, one was more of a design-your-own-data-structure thing. I fumbled the second one initially but recovered by talking through my reasoning. They seemed to care more about the thought process than a clean solution.

Round 4: System design. I got "design a log aggregation pipeline that can handle 1M events/sec." Very in-their-wheelhouse, obviously. If you haven't thought through Kafka vs. Pulsar tradeoffs or how you'd handle backpressure, prep that.

Round 5: Behavioral. Two interviewers, 4 questions. Very structured, lots of follow-up. "Tell me about a time you disagreed with a technical direction" had about 3 layers of follow-ups. Felt like they were actually trying to figure out how I think, not just checking a box.

Got an offer. The behavioral prep mattered more than I expected going in.

4 replies

visa_vik

the system design round you described sounds intense. did they give you any heads up on the topic beforehand or is it totally blind? asking because I'm interviewing there in 6 weeks and I'm on H1B so I really can't afford to fumble.

backend_bekah

no heads-up at all. totally blind. i'd just make sure you know the observability/logging domain well. think about how Splunk's own product works and use that as a mental model. they're not going to ask you to design Twitter.

sre_sol

"design a log aggregation pipeline at 1M events/sec" is basically Splunk's entire business. that's a good sign actually, means the interview is grounded in real problems not contrived puzzles. did they want you to go deep on the indexing layer or mostly stay at the ingest/queue level?

careerveteran

the layered follow-ups on behavioral questions is something I've seen more of post-Cisco acquisition, actually. a lot of the old Splunk culture was pretty startup-loose on the behavioral side. sounds like they've tightened the rubric. not necessarily bad, but bring your receipts.