Alerting
Highlighted

Alert Escalation?

SplunkTrust
SplunkTrust

Is it possible to have an Alert that will, after some set amount of notifications, start to email to a different set of addresses? That is to say, replicate the behavior possible with Nagios as described here

Tags (2)
0 Karma
Highlighted

Re: Alert Escalation?

Splunk Employee
Splunk Employee

Hi,

There's no way to handle alert escalation out of the box.

You could, however, edit the sendemail.py Python script that fires when an alert triggers to introduce/keep state and handle escalation logic. You would need to be versant in Python to do so.

Cheers

View solution in original post

0 Karma
Highlighted

Re: Alert Escalation?

Explorer

Hi muebel,

This might be a bit old, but did you find out a way to do this? I am facing a similar situation and this is what I could dig:

1-https://answers.splunk.com/answers/725485/escalate-an-alert-to-a-different-email-address-aft-1.html?...

2-https://answers.splunk.com/answers/237950/triggering-an-alert-on-alerts-alert-on-alerts.html

thanks.

0 Karma