Reroute incidents
Splunk On-Call offers the ability to route an existing incident to individual users, teams of users, or escalation policies.
Sometimes, users who are paged for an issue may need to reroute the incident to another team or to a specific individual. Splunk On-Call offers the ability to route an existing incident to individual users, teams of users, or escalation policies.
What you need to know
-
When an incident is routed directly to a user, the user will be paged in accordance with their personal paging policy until the incident has been acknowledged.
-
When an incident is routed to one or more escalation policies, it will page and escalate in accordance with the steps indicated in the policy.
-
Ensure your team members have set up their policies appropriately so that important incidents are routed to active email addresses.
Reroute incidents using the web portal
From the Incident Management panel, select the reroute symbol:
To reroute an incident to an escalation policy, select the Escalation Policies tab. Select the policy from the list or search for one using the search field.
Selecting an escalation policy will cause the incident to be processed by that policy, which may or may not result an any users being notified immediately depending on the way the policy is configured.
To reroute an incident to a user, select the Users tab. Select the user from the list or search for one using the search field.
Selecting a user to reroute to will invoke notifications according to that user's personal paging policy.
Once you have selected the appropriate users or policies, select Reroute.
Reroute incidents using mobile
To reroute an incident directly from a push notification:
Hold down the notification.
Select Reroute.
To reroute an incident from the mobile application:
Select the incident.
In the bottom-right corner, select Reroute.
On the Reroute Incident page, select the escalation policies or direct users to be notified in the reroute.
Select Reroute in the upper-right corner.