Impact of Rotation Deletion on Escalation Policies and Routing Keys.

Applicability

Description

In Splunk On‑Call, rotations are commonly used within escalation policies to notify the on‑duty user at a given time. Escalation policies may consist of multiple steps, some of which reference rotations, while others notify specific users directly. Routing keys are used to associate incoming incidents with the appropriate escalation policy.

A frequent point of confusion is whether deleting a rotation has broader consequences, such as modifying the escalation policy itself or impacting the routing key associated with that policy. 

Investigation

An escalation policy is configured for the Token Management Application—VCES team and consists of three escalation steps. The first step is configured with Notify the on‑duty user(s) in rotation—TMA, while the remaining two steps are configured using the Notify user option.

When the TMA rotation is deleted, only the escalation policy step that references Notify the on‑duty user(s) in rotation is removed. The remaining steps in the escalation policy continue to function as configured and are not affected by the deletion of the rotation. The routing key associated with the policy, TMA‑VCES, is not impacted.

Resolution

The behavior was validated by reviewing how rotations are referenced within escalation policies in Splunk On‑Call. When a rotation is deleted, the system removes only the escalation policy step that is explicitly configured to notify the on‑duty user(s) in that rotation. No other steps within the escalation policy are affected by this action.

Escalation steps that are configured to notify individual users remain intact and continue to operate as configured. The escalation policy itself is not deleted or disabled as a result of the rotation removal.

Additionally, routing keys associated with the escalation policy remain unchanged. Since routing keys are linked to the escalation policy as a whole and not to individual escalation steps or rotations, incident routing continues to function normally after the rotation is deleted.

This behavior ensures that removing a rotation does not disrupt the overall incident routing or escalation process beyond the specific step that referenced the deleted rotation.