Skip to main content
Observer integrates with Splunk On-Call (formerly VictorOps) through its generic alert endpoint. One Observer incident maps to one Splunk On-Call incident by entity id. Splunk On-Call is in beta.

​
Set up

1

Enable the generic integration

In Splunk On-Call, open Integrations and enable the Generic (REST) integration. Note the API key in the integration URL, and create or choose a routing key that maps to the right escalation policy.
2

Add the integration in Observer

In the console, open Alerts, choose Add alert, pick Splunk On-Call, and enter the API key and routing key. Choose org-wide or a single page, then save.
3

Test it

Use Send test from the row’s actions menu. A test incident should open in Splunk On-Call. Recover it when you are done.

​
Lifecycle mapping

The entity id is derived from the Observer incident id (observer-incident-<id>). Splunk On-Call correlates messages with the same entity id, so updates land on the open incident and the recovery closes the right one.
Severity mappingCritical and major map to CRITICAL; minor maps to WARNING. Scheduled maintenance does not page.

​
Troubleshooting

  • No incident appears: confirm both the API key and the routing key are correct, and that the routing key maps to an active escalation policy.
  • Wrong escalation: the routing key controls who is paged. Adjust it in Splunk On-Call, not in Observer.