Alert Escalation?

[muebel]

Is it possible to have an Alert that will, after some set amount of notifications, start to email to a different set of addresses? That is to say, replicate the behavior possible with Nagios as described here

[mmaqbool]

Hi muebel,

This might be a bit old, but did you find out a way to do this? I am facing a similar situation and this is what I could dig:

1-https://answers.splunk.com/answers/725485/escalate-an-alert-to-a-different-email-address-aft-1.html?...

2-https://answers.splunk.com/answers/237950/triggering-an-alert-on-alerts-alert-on-alerts.html

thanks.

[malmoore · Accepted solution]

Hi,

There's no way to handle alert escalation out of the box.

You could, however, edit the sendemail.py Python script that fires when an alert triggers to introduce/keep state and handle escalation logic. You would need to be versant in Python to do so.

Cheers