Alerting

Alert Escalation?

muebel
SplunkTrust
SplunkTrust

Is it possible to have an Alert that will, after some set amount of notifications, start to email to a different set of addresses? That is to say, replicate the behavior possible with Nagios as described here

Tags (2)
0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi,

There's no way to handle alert escalation out of the box.

You could, however, edit the sendemail.py Python script that fires when an alert triggers to introduce/keep state and handle escalation logic. You would need to be versant in Python to do so.

Cheers

View solution in original post

0 Karma

mmaqbool
Explorer

Hi muebel,

This might be a bit old, but did you find out a way to do this? I am facing a similar situation and this is what I could dig:

1-https://answers.splunk.com/answers/725485/escalate-an-alert-to-a-different-email-address-aft-1.html?...

2-https://answers.splunk.com/answers/237950/triggering-an-alert-on-alerts-alert-on-alerts.html

thanks.

0 Karma

malmoore
Splunk Employee
Splunk Employee

Hi,

There's no way to handle alert escalation out of the box.

You could, however, edit the sendemail.py Python script that fires when an alert triggers to introduce/keep state and handle escalation logic. You would need to be versant in Python to do so.

Cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...