Get phone and SMS alerts fromSplunk
Splunk indexes machine data from across your stack — logs, events, and security telemetry — and its scheduled searches and correlation rules fire when a pattern crosses a threshold. Spike turns those Splunk alerts into incidents, routed to the on-call engineer by phone, SMS, Slack, and email, with escalation.
Set up with AI
I use Splunk for monitoring and Spike for on-call and incident management. Walk me through connecting them: create a Splunk integration in Spike, copy its webhook URL, and add that webhook to Splunk alert settings. Then help me send a test alert to confirm incidents show up in Spike.
What is Splunk?
Splunk is the workhorse for searching and analyzing machine data at scale. It ingests logs and events from applications, servers, network devices, and security tools, indexes everything, and lets you query it with SPL. Scheduled searches, alerts, and correlation rules run against that data continuously — flagging an error signature spiking in the logs, an authentication anomaly, a service that has gone quiet, or a SIEM detection that matches a threat pattern.
A Splunk alert on its own drops an email or writes to a lookup, which is easy to overlook when an incident is unfolding. Connected to Spike, each triggered alert becomes an incident: the on-call engineer gets a phone call and SMS within seconds, security and reliability alerts escalate to the next responder if they go unacknowledged, and repeated fires from the same search are grouped so a noisy detection doesn’t overwhelm the pager. Because Spike handles Splunk’s resolution signal, the incident closes itself once the condition clears — keeping your timeline accurate without manual cleanup.
How to set up Splunk alerts
Every Spike integration is a unique webhook URL. Paste it into Splunk and alerts start flowing — no agents, no code.
Step 1: Create a Splunk integration in Spike
In your Spike dashboard, open Integrations and choose Splunk. Spike generates a unique webhook URL for this integration — copy it.
Step 2: Add a webhook action to your Splunk alert
In Splunk, open the Alerts page and create or edit the alert rule you want to notify from. Under its trigger actions or recipients, choose the Webhook action.
Step 3: Paste the Spike URL and test
Paste the Spike webhook URL into the action and save the alert. Run the search or wait for it to trigger — the alert reaches Spike as an incident within seconds, and resolves automatically when the condition clears.
That's it — Splunk alerts now page whoever is on call.
