Get Incident
Get incident by ID.
External Documentation
To learn more, visit the Splunk Observability documentation.
Parameters
Parameter | Description |
---|---|
Incident ID | The ID of the incident. Can be obtained from List Incidents action. |
Example Output
{
"active": false,
"anomalyState": "ANOMALOUS",
"detectLabel": "string",
"detectorId": "string",
"duration": 0,
"events": [
{
"anomalyState": "ANOMALOUS",
"detectLabel": "string",
"detectorId": "string",
"detectorName": "x",
"event_annotations": {
"<property name>": "any"
},
"id": "string",
"incidentId": "string",
"inputs": [
{
"dimensions": {
"<property name>": "any"
},
"fragment": "string",
"value": 0
}
],
"severity": "Critical",
"timestamp": 1557484230000
}
],
"incidentId": "string",
"linkedTeams": [
"AbcdEf1ABCD",
"FO1Vq3ABXYZ"
],
"severity": "Critical"
}
Workflow Library Example
Get Incident with Splunk Observability and Send Results Via Email