This course is targeted towards Splunk On-call admins responsible for setting up incident response with Splunk On-Call. This 1-virtual day course describes the tasks required to set up on-call teams, including defining schedules, on-call rotations and shifts. Learn to set-up and configure alerts and integrations. Create post-incident review reports, track response metrics and customize reports. Use advanced features such as the Rules engine for advanced customization and configure webhook integrations. All concepts are taught using lectures and scenario-based hands-on activities.

• Set up Splunk On-Call teams
• Set up integrations and configure alerts
• Report on team activity and performance
• Use the Rules engine to trigger custom alerts
• Set up webhook integrations

Module 1: Introduction and Planning

• Identify features desirable in an incident response system
  
• Create a plan for incident response
  
• Describe the flow of a typical incident in Splunk On-Call
• Describe the general layout of the UI / functionality
  
• Explain the Splunk on-call concepts including:

Escalation Policies, Incidents, and Actions

• Create new users
  
• Create users paging (notification) policies
  
• Plan on-call schedules
  

Module 2: Users, Teams, Rotations and Escalation Policies

Module 3: Configuring Integrations and Alerts

Module 4: Reporting on Team Activity and Performance

Module 5: Advanced Features