Re-open Resolved Incidents

Use the re-open action to return a resolved incident to an active state when the underlying issue recurs or the incident was resolved too early.

Overview

Splunk On-Call lets you re-open a resolved incident within 5 days after it is resolved. Re-opening changes the incident back to the Triggered state, restarts escalation from the beginning, and pages on-call responders again. The incident keeps the same incident number and existing timeline history.

Requirements

  • The re-open resolved incidents feature must be enabled with the reopenincidents feature flag.
  • You must be a full member of the organization; Stakeholder users cannot reopen incidents.
  • The incident must have been resolved within the last 5 days.
  • No other active incident can exist for the same entity.
  • The original first alert data must still be available. If this data has been removed, the re-open action fails.

If a new incident has already been created for the same entity after the original incident was resolved, the re-open action is unavailable.

What happens when you re-open an incident

  1. The incident returns to the Triggered state.
  2. Previous acknowledgment details remain visible after the incident is re-opened.
  3. Escalation restarts from the first step of the recovered original escalation policies. If the original policies are unavailable or no longer exist, Splunk On-Call uses the current routing policies.
  4. On-call responders are paged using the recovered escalation policies and personal notification settings. If the incident is muted by a maintenance mode window, escalation and paging do not start.
  5. A chat message and SMS notification are sent to the user who was initially paged. The message indicates that the incident was re-opened, using the format Reopened by <username> for #<incidentNumber>.
  6. A timeline entry records who re-opened the incident and when.

All previous incident history remains attached to the same incident.

Re-open an incident in Splunk On-Call

  1. Open the Incident Pane.
  2. Select the Resolved tab.
  3. Open the incident you want to re-open.
  4. Select Re-open.

If the incident is eligible, it immediately moves back into the active incident flow and starts paging from the beginning of its escalation policy.

Behavior and limitations

  • The re-open action is available only for 5 days after the incident is resolved.
  • If the 5-day window has passed, the action is no longer available.
  • If another active incident exists for the same entity, you cannot re-open the resolved incident.
  • Re-opening always restarts escalation from the first step, even if the incident had previously progressed farther before it was resolved.
  • Re-opening requires the original first alert to remain available. If the first alert data is no longer stored, the re-open action fails.
  • If the incident is muted by a maintenance mode window, escalation and paging do not start upon re-open.

Response codes:

Status code Description Typical cause
200 OK The incident was re-opened successfully. The request is valid and the incident is eligible for re-open.
400 Bad Request The incident cannot be re-opened because the re-open window has expired. The 5-day re-open window has passed.
400 Bad Request The incident cannot be re-opened because another active incident already exists for the same entity. The entity has an open incident created after the original incident was resolved.
403 Forbidden The incident cannot be re-opened because the reopenincidents feature flag is disabled. reopenincidents feature flag is not enabled for the organization.
404 Not Found The specified user is not a member of the organization. The V1 userName value does not match an org member.
500 Internal Server Error An internal error occurred while processing the re-open request. Service failure.