Splunk On-Call
Splunk On-Call incidents, alerts, escalation policies, teams, routing keys, schedules, and webhooks
Tools
| Name | Description |
|---|---|
list_current_incidentsList currently open, acknowledged, and recently resolved Splunk On-Call incidents. | List currently open, acknowledged, and recently resolved Splunk On-Call incidents. |
search_incident_historySearch incident history with pagination. The reporting endpoint is rate limited to once per minute. | Search incident history with pagination. The reporting endpoint is rate limited to once per minute. |
get_incidentGet detailed data for one Splunk On-Call incident by incident number. | Get detailed data for one Splunk On-Call incident by incident number. |
create_incidentCreate a manual Splunk On-Call incident for exact users or escalation policies. Requires explicit confirmation. | Create a manual Splunk On-Call incident for exact users or escalation policies. Requires explicit confirmation. |
acknowledge_incidentAcknowledge exact Splunk On-Call incident numbers. Requires explicit confirmation. | Acknowledge exact Splunk On-Call incident numbers. Requires explicit confirmation. |
resolve_incidentResolve exact Splunk On-Call incident numbers. Requires explicit confirmation. | Resolve exact Splunk On-Call incident numbers. Requires explicit confirmation. |
get_alertRetrieve Splunk On-Call alert details by alert UUID. | Retrieve Splunk On-Call alert details by alert UUID. |
list_on_call_usersGet current on-call users across the organization. | Get current on-call users across the organization. |
get_team_scheduleGet a team on-call schedule. | Get a team on-call schedule. |
list_teamsList Splunk On-Call teams. | List Splunk On-Call teams. |
list_escalation_policiesList escalation policy summaries and associated teams. | List escalation policy summaries and associated teams. |
list_routing_keysList routing keys with associated teams and escalation policies. | List routing keys with associated teams and escalation policies. |
list_alert_rulesList Splunk On-Call alert rules. | List Splunk On-Call alert rules. |
create_alert_ruleCreate a Splunk On-Call alert rule from a raw official API payload. Requires explicit confirmation. | Create a Splunk On-Call alert rule from a raw official API payload. Requires explicit confirmation. |
update_alert_ruleUpdate one Splunk On-Call alert rule by exact rule ID. Requires explicit confirmation. | Update one Splunk On-Call alert rule by exact rule ID. Requires explicit confirmation. |
delete_alert_ruleDelete one Splunk On-Call alert rule by exact rule ID. Requires explicit confirmation. | Delete one Splunk On-Call alert rule by exact rule ID. Requires explicit confirmation. |
Triggers
| Name | Description |
|---|---|
incident_webhook_receivedReceive Splunk On-Call outgoing incident webhook payloads. Configure this URL in Splunk On-Call outgoing webhooks. | Receive Splunk On-Call outgoing incident webhook payloads. Configure this URL in Splunk On-Call outgoing webhooks. |
new_or_updated_incidentPoll current Splunk On-Call incidents for new or changed incident phase/alert count. | Poll current Splunk On-Call incidents for new or changed incident phase/alert count. |
Quick Start
import { WeavzClient } from '@weavz-io/sdk'
const weavz = new WeavzClient({ apiKey: 'wvz_...' })
const result = await weavz.actions.execute('splunk-on-call', 'list_current_incidents', {
workspaceId: '550e8400-e29b-41d4-a716-446655440000',
integrationAlias: 'splunk-on-call',
input: { /* ... */ },
})Related Integrations
Works well with
Frequently Asked Questions
How do I connect Splunk On-Call to my app?
Use Weavz Hosted Connect for Custom authentication. Install the SDK, create a connection through the connect portal or API, then execute tools programmatically.
What tools does Splunk On-Call support?
Splunk On-Call supports 16 tools including List Current Incidents, Search Incident History, Get Incident, Create Incident, Acknowledge Incident, and more.
Can I use Splunk On-Call with AI agents?
Yes. Add Splunk On-Call to an MCP server in Tool Mode or Code Mode. Code Mode provides 3 meta-tools with on-demand API discovery so agents can compose stateful workflows without loading every action schema up front.
How do I connect Splunk On-Call to ChatGPT or Claude?
Open the Weavz connector setup, sign in, choose a workspace, and add Splunk On-Call as an approved app. ChatGPT, Claude, and other remote MCP clients can then call the scoped Splunk On-Call tools exposed by that workspace.
Does Splunk On-Call work with Claude Code, Cursor, Codex, and local agents?
Yes. Remote and local MCP clients can connect to a Weavz MCP endpoint for the workspace. Local coding agents can also use the Weavz CLI to inspect apps, discover actions, run approved Splunk On-Call work, and execute Code Mode workflows from a terminal.
What can I ask an AI agent to do with Splunk On-Call?
Splunk On-Call exposes 16 tools, including List Current Incidents, Search Incident History, Get Incident, Create Incident, Acknowledge Incident, and more. Use Weavz to keep credentials scoped, require approval for sensitive work, and audit what the agent did.
Can Splunk On-Call be used in stateful agent workflows?
Yes. Agents can combine Splunk On-Call tools with Filesystem, State KV, Human Gates, input partials, and other workspace integrations while keeping execution scoped to the selected workspace or end user.
What authentication does Splunk On-Call use?
Splunk On-Call uses Custom. Weavz stores credentials securely and uses them for authorized action execution.
How much does the Splunk On-Call integration cost?
The Splunk On-Call integration is included on all Weavz plans including the free tier with 20,000 actions per month. No credit card required.
What triggers does Splunk On-Call support?
Splunk On-Call supports 2 triggers including Incident Webhook Received, New or Updated Incident.
Connect Splunk On-Call in minutes
Get 20,000 free action executions every month. No credit card required.