Module 1 – Introduction and Planning

• Create an incident response plan
• Explain the typical incident flow in Splunk On-Call
• Define key concepts in Splunk On-Call, including Escalation Policies, Incidents, and Actions
• Create new user accounts
• Establish user paging (notification) policies
• Plan on-call schedules

Module 2 – Users, Teams, Rotations, and Escalation Policies

• Describe the Splunk On-Call setup process
• Differentiate between Splunk On-Call user roles
• Create teams and add users using both the UI and API
• Add and remove team managers
• Create on-call schedules, including shifts, rotations, and members
• Develop Escalation Policies for handling incoming incidents

Module 3 – Configuring Integrations and Alerts

• Explain the role of a routing key
• Create routing keys following best practices
• Configure Splunk On-Call integrations

Module 4 – Reporting on Team Activity and Performance

• Differentiate between various types of reports
• Create post-incident review reports
• Monitor response metrics
• Customize on-call review reports
• Track incident flow using the Incident Frequency report (Enterprise edition only)

Module 5 – Advanced Features

• Utilize the Alert Rules Engine to add annotations to incidents
• Apply the Alert Rules Engine to transform alerts
• Re-route or mute incidents based on their content
• Create outgoing Webhooks to extend product functionality
• Explore the public API portal for details on the public API

Splunk On-Call Administration Course Prerequisites:

• None