Snooze an incident

Triggered or acknowledged incidents can be snoozed by selecting the clock icon on the incident cards in the incident pane. The icon is found in the upper right-hand corner of the card.

Selecting this icon prompts the user with a modal to select an end time for the snooze. Incidents can be snoozed in 30-minute increments up to 24 hours.

After an incident is snoozed, a new incident message is sent to the timeline indicating who snoozed the incident and the expiration time:

The incident will remain under the Acknowledged tab in the Incidents panel until the snooze expires. If a triggered incident is snoozed, Splunk On-Call will automatically move it to the Acknowledged tab. If an acknowledged incident is snoozed, it will remain acknowledged.

When snooze expires

When a snooze expires, the incident will begin paging the on-call user for the previously paged escalation policy. If the incident didn’t have a policy associated (for example, if the incident was created manually and sent to a single user), then that user will be paged.

Change snooze expiration time

If you need more time for a different task or have selected the wrong expiration time, modify the snooze by selecting the Snoozed Until link.

Now select a new expiration time for the snooze.

Reroute or resolve snoozed incidents

Snoozed incidents can be rerouted or resolved. Both of these actions effectively end the snooze.

Cancel a snooze

To cancel a snooze, reroute the incident to yourself. For information on rerouting an incident, see Re-route incidents.

Who can snooze?

Anyone can snooze any triggered or acknowledged incident. If a user snoozes an incident that was previously acknowledged by someone else, that incident becomes snoozed or acknowledged in that user’s name.

Only the user who snoozed an incident can modify the snooze time on the incident.