Skip to main content

Splunk On-Call

Causely can send high-context causal insights directly to Splunk On-Call (formerly VictorOps), so your on-call team receives the signal, not the noise. With enriched context like impacted services, problem severity, and diagnostic summaries, alerts become more actionable and reduce time-to-resolution.

Splunk On-Call can be used as a notification destination in Causely.
How you configure this integration depends on how notifications are managed in your environment.

Causely supports two configuration paths:

  • Managed Notifications (recommended)
    Routing rules are configured in the Causely UI based on impact, severity, and context.
    Splunk On-Call is used as the on-call delivery destination, ensuring alerts reach the right responders with full causal context.

  • Mediator-based Notifications (advanced)
    Notifications are configured programmatically using the Causely Mediator and sent directly to Splunk On-Call using its generic webhook integration.

Routing and notification rules for Managed Notifications are configured in the Causely UI: Set up notification routing in the UI

Mediator-based Configuration​

To enable the Splunk On-Call integration, update your causely-values.yaml file to include the executor and your Splunk On-Call URL and routing key.

For example, add the following in your causely-values.yaml file like this:

mediator:
  notifications:
    enabled: true

You can define a Splunk On-Call notification integration through the Causely UI, or by creating a secret in your Kubernetes cluster, in the causely namespace:

apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: splunk-notification-config
  namespace: causely
  labels:
    causely.ai/notif-config: Splunk
stringData:
  notif_config_filters: "[]"
  notif_config_filters_enabled: "true"
  notif_config_global: "false"
  notif_config_name: splunk
  notif_config_token: "causely"
  notif_config_type: Splunk
  notif_config_url: https://alert.victorops.com/integrations/generic/12356789/alert/ab12cd34-ef56-7890-ab12-34cd56ef7890
note

Replace the placeholder values with your actual integration URL and routing key from Splunk On-Call.

To install the Causely agent with the Splunk On-Call integration enabled, run:

causely agent install --cluster-name <cluster-name> --values ./causely-values.yaml

Notification Payload Format​

Causely sends structured alert payloads to Splunk On-Call, including rich metadata about the actual causes and their service-level impact.
For an example payload and explanation of each field, refer to the Notification Payload Format page.