You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Sep 2, 2025. It is now read-only.
Copy file name to clipboardExpand all lines: alerts-detectors-notifications/alerts-and-detectors/alerts-detectors-notifications.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -85,7 +85,7 @@ To learn more, see :ref:`condition-reference`.
85
85
<h2>Alerts<aname="alerts"class="headerlink"href="#alerts"title="Permalink to this headline">¶</a></h2>
86
86
</embed>
87
87
88
-
When data in an input MTS matches a condition, the detector generates a trigger event and an alert that has a specific severity level. You can configure an alert to send a notification using Splunk On-Call. For more information, see the :new-page:`Splunk On-Call <https://help.victorops.com/>` documentation.
88
+
When data in an input MTS matches a condition, the detector generates a trigger event and an alert that has a specific severity level. You can configure an alert to send a notification using Splunk On-Call. For more information, see the :ref:`about-spoc` documentation.
89
89
90
90
Alert rules use settings you specify for built-in alert conditions to define thresholds that trigger alerts. When a detector determines that the conditions for a rule are met, it triggers an alert, creates an event, and sends notifications (if specified). Detectors can send notifications via email, as well as via other systems, such as Slack, or via a webhook.
Copy file name to clipboardExpand all lines: get-started/overview.rst
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -105,7 +105,7 @@ For more information, see :ref:`logs-intro-logconnect`.
105
105
106
106
Splunk On-Call incident response software aligns log management, monitoring, chat tools, and more, for a single-pane of glass into system health. Splunk On-Call automates delivery of alerts to get the right alert, to the right person, at the right time.
107
107
108
-
For more information, see the :new-page:`Splunk On-Call documentation <https://help.victorops.com/>`.
Copy file name to clipboardExpand all lines: sp-oncall/alerts/team-dashboard.rst
+9-36Lines changed: 9 additions & 36 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,71 +19,44 @@ All incidents derived from integrated monitoring tools in the incident table inc
19
19
source of an alert. Manually created incidents, along with incidents originating from the Email Endpoint or the REST API integrations, will
20
20
remain logo free.
21
21
22
-
Information Alerts can still be found on the `Timeline Page. <https://help.victorops.com/knowledge-base/timeline/>`__
23
-
24
-
|image|
25
-
22
+
Information Alerts can still be found on the timeline page. See :ref:`timeline`.
26
23
27
24
Filters
28
25
-------
29
26
30
27
The filters provide an easy way for you to see exactly what you are looking for and nothing else. Whether you want to filter by team or by incident state, these filters allow for you to see only what is relevant to you. You can filter the incident table first by team status (with default team associations), as well as incident state.
31
28
32
-
image _images/spoc/Filters-scaled.jpg
33
-
34
29
Incident Table
35
30
--------------
36
31
37
32
Quickly identify responsible parties during a firefight by easily seeing which policies are being paged, take action on an incident (acknowledge, add responder, reroute, snooze, resolve), and see the status of incidents. You can also find annotation counts, chats, and associated alerts.
38
33
39
-
image: _images/spoc/Incidents-scaled.jpg
40
-
41
34
Manual Incident Creation
42
35
^^^^^^^^^^^^^^^^^^^^^^^^^^^
43
36
44
-
You can create a manual incident from the team dashboard by selecting
45
-
“Create Incident” in the top right corner `following these
Access incident details directly from the team dashboard by selecting the incident number link. This will expand the incident and its event history in the incident war
43
+
room. See :ref:`war-room`.
55
44
56
45
People Table
57
46
------------
58
47
59
-
See a list of users that are on-call for the teams that you have
60
-
filtered for. You can see which teams that these users are on call for,
61
-
as well as clicking the user's name to take on-call or see these user's
62
-
upcoming shifts.
48
+
See a list of users that are on-call for the teams that you have filtered for. You can see which teams that these users are on call for, as well as clicking the user's name to take on-call or see these user's upcoming shifts.
63
49
64
-
You can navigate to the team's view below to see other user's associated
65
-
with teams.
50
+
You can navigate to the team's view below to see other user's associated with teams.
66
51
67
52
Take On-Call from Another User
68
53
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
69
54
70
-
Navigate to a user in the on-call list, and click the user's name. From
71
-
here, you can take the shift from a user from the pop over.
55
+
Navigate to a user in the on-call list, and click the user's name. From here, you can take the shift from a user from the pop over.
72
56
73
-
To revert an on-call take, click the “clear take” button from the
74
-
popover associated with your profile.
75
-
76
-
_images/spoc/People-Table.jpg
77
-
78
-
_images/spoc/Take-On-Call.jpg
79
-
80
-
57
+
To revert an on-call take, click the “clear take” button from the popover associated with your profile.
81
58
82
59
Status Page
83
60
~~~~~~~~~~~
84
61
85
-
You can relay service status updates via statuspage.io by `following
Copy file name to clipboardExpand all lines: sp-oncall/alerts/team-escalation-policy.rst
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,8 +12,8 @@ Escalation policies determine set who is actually on-call for a given team and a
12
12
Some things to note:
13
13
14
14
- Only Team and Global Admins are able to make changes to Escalation Policies
15
-
- Only users specified in the first step of an Escalation Policy will receive Timeline and Push notifications that they are on-call and will log hours in the on-call report as being on-call. If you would like users in subsequent steps of an escalation policy to receive these notifications and log these hours, see `this guide. <https://help.victorops.com/knowledge-base/tips-tricks-multiple-escalation-policies/#tip-3-surface-secondary-on-call-schedules-in-your-on-call-calendar>`__
16
-
- When an Escalation Policy is executed and a user is being notified, the user's `personal paging policy <https://help.victorops.com/knowledge-base/paging-policy/>`__ determines how they will be contacted.
15
+
- Only users specified in the first step of an Escalation Policy will receive Timeline and Push notifications that they are on-call and will log hours in the on-call report as being on-call. If you would like users in subsequent steps of an escalation policy to receive these notifications and log these hours, see :ref:`multi-escalation-policies`.
16
+
- When an Escalation Policy is executed and a user is being notified, the user's personal paging policy determines how they will be contacted. See :ref:`custom-paging-policy`.
17
17
18
18
Steps to Creating an Escalation Policy
19
19
============================================
@@ -64,7 +64,7 @@ A number of escalation actions are available. The different options are as follo
64
64
- This will notify every member of the team that the escalation policy is created for regardless of the time of day. All users on the team will be paged for an incident, but only one user is required to ack the incident.
65
65
66
66
* - Execute webhook
67
-
- This will execute the `Escalation Webhook <https://help.victorops.com/knowledge-base/escalation-webhooks/>`__ of your choosing
67
+
- This will execute the escalation webhook of your choosing. See :ref:`escalation-webhooks`.
68
68
69
69
* - Send an email to email address
70
70
- This will send an email to the email address you specify
The post-incident review report from Splunk On-Call allows you to gain historical insight on events surrounding a particular incident or range of time, so the next time a similar situation arises, you have a documented account of how you solved the problem. We believe it's important to not just catalog what happened in an incident, but to analyze the event in its entirety, and define actionable steps that help a team or organization dive deeper into the data.
12
11
13
-
Creating a post-incident review report
14
-
-----------------------------------------
15
-
16
12
To create a Post-Incident Review Report, access the Splunk On-Call web portal, and then select :guilabel:`Reports`.
17
13
18
14
Select the :guilabel:`Post-Incident Reviews` option and select :guilabel:`New Report`. Enter a title and select :guilabel:`Create Report`.
0 commit comments