Routing Keys in Splunk On-Call
Alert routing gives you the precision required to assign specific types of alerts to specific groups. When the objective is to quickly and accurately target specific team members to deal with a particular incident without unnecessarily notifying your entire team, Routing Keys are the tool to use.
Note that routing keys are case insensitive and should only be composed of letters, numbers, hyphens, and underscores.
You can create and manage your Routing Keys by navigating to Settings >> Routing Keys.
Creating Routing Keys in Splunk On-Call
After navigating to Settings >> Routing Keys, you can create a new routing key by clicking the “Add Key” button. Give the Routing Key a name and then assign the Routing Key to an Escalation Policy for a team.
Routing Rules in Splunk On-Call
When an alert is delivered to Splunk On-Call, your routing rules (as indicated in the table at Settings >> Routing keys) determine which team an alert or incident will be routed to. When an incident is routed to a particular escalation policy, that escalation policy determines who to notify, and who to escalate to if the incident stays unacknowledged. Routing Keys for alerts are specified in your monitoring tool configuration for the integration, and as such can be determined from within integration configurations.
Find the Routing Key for an Alert
All types of alerts have a routing key assigned to them by the user who configured the integration for the monitoring tool that sent the alert. This is the key used to map an alert to an escalation policy (as described immediately above). To find the routing key for an alert, click into the alert details for the alert in question. You will see the routing key in the list of key/values under the VictorOps Fields section.
- Each team should have one routing key that is not shared with any other teams. Naming of the routing keys after the respective team name will also reduce confusion.
- Keep the names of routing keys simple. Naming keys intuitively will obviously indicate which team or teams the key associates with.
- A well-made set of routing keys will make filtering the timeline a breeze. A filtered timeline is the easiest way to hone in on exclusively the events that are important to you.