Only 25 people, at 22 organizations, pass a strict 2025-or-later bar for hands-on Splunk use — not 1,000
Asked:
“daniel wilson of voleon, splunk customer - give me 100 more lookalikes like him. i want to go after splunk customers.”
Asked (follow-up):
“go over all results and only provide people where it's shown they use splunk in 2025 or later (since a lot of the proof you've provided are people that have implemented or used splunk from many years ago). make a list of 1000 of them.”
Of a candidate pool of 1,349 extracted rows, 51 evidence rows passed strict semantic screening and collapsed to 25 unique person–employer records with public proof of personally using, administering, or describing an active Splunk deployment in 2025 or later. That is 25 of the 1,000 requested: a source published in 2025+ was not enough — the underlying Splunk activity itself had to be explicitly current. Padding with historical, training-only, certification-only, vendor, or inferred records was rejected.
The 25 verified people, by evidence year and use case
Vendor-published evidence (Splunk-owned page)
Independent source (AWS, LinkedIn, Imply, YouTube, analysts, events)
Hover or tap a chip for the exact proof and source
Security / SIEM dominates: 18 of 25 verified people run Splunk for security operations, fraud, or threat detection — e.g. M bank's security head cut MTTD/MTTR 50% on Splunk ES (
splunk.com).
15 of the 25 have 2026-dated activity, the freshest signal — including Asurion's SIEM architecture lead validating 140 notable rules with Splunk AI Assistant 2.0 (
splunk.com).
13 of 25 rows rest on Splunk-owned customer materials; independent corroboration includes Siemens engineers on an AWS case study describing live Splunk security pipelines (
aws.amazon.com).
Several records show Splunk under cost pressure, still retained for high-value real-time security — UKG routes expensive logs around Splunk into BigQuery while keeping it as the SIEM (
victorinollc.com) and BTG Pactual put Imply Lumi under its Splunk workflows (
imply.io).
Before outreach — methodology and caveats
- Verify current employment and current product usage independently before contacting anyone; evidence here is a public snapshot, not a live CRM record.
- No contact details are provided and none should be invented; use the linked source to locate the person through legitimate channels.
- An active role extending into 2025 qualified only when the same role explicitly described Splunk duties — a 2025+ publication date alone was never sufficient.
- Vendor-published customer evidence (Splunk-owned pages back 13 of 25 rows) is labeled; treat it as marketing-reviewed but customer-attributed. No single URL backs more than two rows.
- Excluded: historical deployments, ambiguous mentions, training-only or certification-only records, Splunk employees, consultants and resellers, and inferred usage. The honest count is 25, not 1,000.
Final verified dataset: 25 rows, one per person–employer pair, screened from 1,349 candidate rows (51 passed strict semantic screening; duplicate URLs and repeated case-study variants collapsed). Each row records job title, employer, the date of the qualifying 2025-or-later Splunk activity, the exact usage description, use case, and source URL. Use-case grouping (security/SIEM vs observability/IT operations) assigned from the stated use case. Vendor-published means a Splunk-owned host. Proof text shortened for space in the chart tooltip; full text in the table.