splunk-oncall-setup

Render and apply Splunk On-Call configurations from YAML/JSON specs.

36|7|Updated Mar 17, 2026
One-click install
npx skills add https://github.com/chambear2809/splunk-cisco-skills --skill splunk-oncall-setup
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: splunk-oncall-setup
Source: https://github.com/chambear2809/splunk-cisco-skills/tree/main/skills/splunk-oncall-setup
Command: npx skills add https://github.com/chambear2809/splunk-cisco-skills --skill splunk-oncall-setup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires PyYAML, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Automates the end-to-end provisioning and operations lifecycle for Splunk On-Call, turning manual configurations into repeatable, auditable workflows.

Core Features & Use Cases

  • Render complete On-Call specifications (teams, users, rotations, escalation policies, routing, notes, rest alerts, and Splunk-side apps) from YAML/JSON.
  • Validate rendered outputs and apply changes to Splunk On-Call when explicitly requested.
  • Use cases include onboarding new teams, updating rotations, enabling auto-recovery, and provisioning Splunk-side integrations.

Quick Start

Render a spec to generate apply-plan.json and payloads/, then run a validation pass and optionally apply changes to production.

Frequently Asked Questions about splunk-oncall-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate Splunk On-Call configuration from YAML or JSON files?

This process streamlines end-to-end provisioning by rendering YAML/JSON specs into validated payloads and applying them via API to configure teams, users, rotations, and escalation policies.

Can I preview Splunk On-Call workflow changes before applying them to production?

Yes, the render-first workflow generates an apply-plan.json and payloads directory, allowing you to validate configurations for teams and escalation policies before applying them to production.

Does this workflow support provisioning Splunk-side companion apps and rest alerts?

Yes, the workflow provisions Splunk-side companion apps, rest alerts, alert routing, and notes directly from your defined YAML or JSON specifications.

How are API rate limits and secret handling managed when applying Splunk On-Call specs?

The workflow enforces strict validation, secret handling, and API rate limits during the apply phase to prevent configuration leaks and ensure safe automated provisioning.

What is the best way to update Splunk On-Call rotations and escalation policies safely?

The best way is to define rotations and escalation policies in YAML, render them to validate the output, and explicitly apply the API actions to ensure repeatable, auditable updates.