Alerting

Alert Escalation?

muebel
SplunkTrust
SplunkTrust

Is it possible to have an Alert that will, after some set amount of notifications, start to email to a different set of addresses? That is to say, replicate the behavior possible with Nagios as described here

Tags (2)
0 Karma
1 Solution

malmoore
Splunk Employee
Splunk Employee

Hi,

There's no way to handle alert escalation out of the box.

You could, however, edit the sendemail.py Python script that fires when an alert triggers to introduce/keep state and handle escalation logic. You would need to be versant in Python to do so.

Cheers

View solution in original post

0 Karma

mmaqbool
Explorer

Hi muebel,

This might be a bit old, but did you find out a way to do this? I am facing a similar situation and this is what I could dig:

1-https://answers.splunk.com/answers/725485/escalate-an-alert-to-a-different-email-address-aft-1.html?...

2-https://answers.splunk.com/answers/237950/triggering-an-alert-on-alerts-alert-on-alerts.html

thanks.

0 Karma

malmoore
Splunk Employee
Splunk Employee

Hi,

There's no way to handle alert escalation out of the box.

You could, however, edit the sendemail.py Python script that fires when an alert triggers to introduce/keep state and handle escalation logic. You would need to be versant in Python to do so.

Cheers

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...