Integration

Splunk On-Call (VictorOps) integration

Splunk On-Call (formerly VictorOps) is an incident response and on-call management service. Create, acknowledge, resolve and reroute incidents, attach notes, read alerts and incident history, see who is on call now and the team and user on-call schedules, take on-call for someone, manage scheduled overrides and their assignments, start and end maintenance mode, post chat and stakeholder messages, and read teams, users, escalation policies, routing keys, rotations, webhooks and alert rules. Account administration (creating, editing or deleting users, contact methods, paging policies, teams and their members, escalation policies, routing keys, rotations and shifts, alert rules) and the deprecated v1 schedule, user and team-policy routes are not exposed. Most calls are limited to 2 per second, incident history to 1 per minute. Authentication is an API ID and an API key created by a Splunk On-Call admin, sent in the X-VO-Api-Id and X-VO-Api-Key headers; a read-only key can only call the read tools.

Connect Splunk On-Call (VictorOps)How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Splunk On-Call (VictorOps).Built from the 50 Splunk On-Call (VictorOps) tools below, on the connection you add once.

What you can do with Splunk On-Call (VictorOps)

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Assignment, 4 operations

delete_override_assignmentDelete override assignmentDELETERemoves the assignment of a scheduled override for one escalation policy.
get_override_assignmentGet override assignmentGETGets the assignment of a scheduled override for one escalation policy: the team, the policy and the user assigned to cover it.
list_override_assignmentsList override assignmentsGETLists the assignments of a scheduled override: for each escalation policy it covers, the team, the policy and the user assigned to cover it.
update_override_assignmentUpdate override assignmentPUTAssigns the user who covers a scheduled override for one escalation policy. acceptOverlap confirms an assignee who already has an absence at that time.

Incident, 4 operations

create_incidentCreate incidentPOSTCreates an incident by hand and pages its targets (users and escalation policies), like the manual incident form. Returns the new incident number. Monitoring tools should send alerts through the REST endpoint integration instead.
get_incidentGet incidentGETGets one incident by its number, whether it is still active or not: phase, start time, alert count, last alert, entity, host, service, paged users, teams and policies, and transitions.
list_incidentsList incidentsGETLists the currently open, acknowledged and recently resolved incidents, each with its phase, alert count, entity, host, service, paged users, teams and policies, and transitions.
search_incident_historySearch incident historyGETSearches incident history by start date, number, entity, host, service, phase or routing key, with offset and limit (100 max). Only resolved incidents unless currentPhase says otherwise. At most one call per minute.

Note, 4 operations

create_incident_noteCreate incident notePOSTAttaches a note to an incident: a unique name, a display name and a JSON object of key value pairs (at most 16 MB).
delete_incident_noteDelete incident noteDELETEDeletes a note from an incident, found by its name.
list_incident_notesList incident notesGETLists the notes attached to an incident: each note's name, display name and JSON value.
update_incident_noteUpdate incident notePUTReplaces a note on an incident, found by its name, with a new display name and JSON value.

Override, 4 operations

create_overrideCreate overridePOSTSchedules an override (a planned absence) for a user between two ISO 8601 times; the covering users are then assigned per escalation policy with update_override_assignment.
delete_overrideDelete overrideDELETEDeletes a scheduled override by its publicId.
get_overrideGet overrideGETGets one scheduled override by its publicId, with its user, start, end, timezone and assignments.
list_overridesList overridesGETLists the scheduled overrides of the organization (planned absences), each with its user, start, end, timezone and the escalation policies it covers.

Rotation, 4 operations

get_rotation_groupGet rotation groupGETGets one rotation group of a team with its shifts and a preview of the on-call periods (skip and count set the weeks shown).
get_rotation_shiftGet rotation shiftGETGets one shift of a rotation group: timezone, start, duration, shift type, time masks, members and on-call periods (skip and count set the weeks shown).
list_rotation_groupsList rotation groupsGETLists a team's rotation groups with their ids and labels, the ids to use with get_rotation_group.
list_team_rotationsList team rotationsGETLists a team's rotations with their shifts, timezones, time masks and the users in each shift.

Team, 3 operations

get_teamGet teamGETGets one team by its slug: name, description, member count and whether it is the default team.
list_teamsList teamsGETLists the teams of the organization, each with its name, slug, description, member count and whether it is the default team.
list_user_teamsList user teamsGETLists the teams a user belongs to, each with its name and slug.

User, 3 operations

get_userGet userGETGets one user by username: first and last name, email, creation date and whether the account is verified.
list_usersList usersGETLists the users of the organization (username, first and last name, email, creation date, verified), or finds users by email address.
take_oncallTake oncallPATCHReplaces the user currently on call in an escalation policy with another user (take on-call). The policy slug often matches the slug of the team that holds it.

Ack, 2 operations

ack_incidentsAck incidentsPATCHAcknowledges one or more open incidents by number on behalf of a user of the organization, with an optional message. Returns the result for each incident.
ack_user_incidentsAck user incidentsPATCHAcknowledges every open incident for which the given user was paged, with an optional message. Returns the result for each incident.

Chat, 2 operations

list_chat_messagesList chat messagesGETLists the organization's chat messages (author, text, time, tags), optionally only those linked to one incident, with limit (default 50, max 200) and offset.
send_chat_messageSend chat messagePOSTPosts a chat message into the Splunk On-Call timeline on behalf of a user, optionally linked to an incident and tagged.

Policy, 2 operations

get_escalation_policyGet escalation policyGETGets one escalation policy by its slug: name, whether it ignores custom paging policies, and its steps with their timeouts and entries (users, rotations, policies, webhooks).
list_escalation_policiesList escalation policiesGETLists the escalation policies of the organization with their slugs and teams, optionally filtered by policy name.

Resolve, 2 operations

resolve_incidentsResolve incidentsPATCHResolves one or more open incidents by number on behalf of a user of the organization, with an optional message. Returns the result for each incident.
resolve_user_incidentsResolve user incidentsPATCHResolves every open incident for which the given user was paged, with an optional message. Returns the result for each incident.

Schedule, 2 operations

get_team_oncall_scheduleGet team oncall scheduleGETGets a team's on-call schedule, overrides included, per escalation policy: who is on call and when, for up to 123 days ahead.
get_user_oncall_scheduleGet user oncall scheduleGETGets a user's on-call schedule across all their teams, overrides included, for up to 123 days ahead.

Admin, 1 operation

list_team_adminsList team adminsGETLists the admins of a team: username, first and last name.

Alert, 1 operation

get_alertGet alertGETGets one alert by its UUID (an incident's lastAlertId): message type, entity, timestamps, state message, monitoring tool, acknowledgement author and message, and the raw alert.

Alert rule, 1 operation

list_alert_rulesList alert rulesGETLists the organization's alert rules (Rules Engine): the alert field and value they match (wildcard or regex), rank, stop flag, routing key, annotations and last update.

Current, 1 operation

list_current_oncallList current oncallGETLists who is on call right now in the organization: for each team, its escalation policies and the users on call for each.

End, 1 operation

end_maintenance_modeEnd maintenance modePUTEnds a maintenance mode, found by its id in get_maintenance_mode.

Log, 1 operation

list_team_oncall_logList team oncall logGETLists a team's on-call shift changes between two timestamps (default: today), optionally for one user. Historical data, up to 15 minutes behind real time.

Maintenancemode, 1 operation

get_maintenance_modeGet maintenance modeGETGets the organization's maintenance mode state: the active maintenance modes, which routing keys each covers (or global), who started it and when.

Member, 1 operation

list_team_membersList team membersGETLists the members of a team: username, first and last name, and whether they are verified.

Reroute, 1 operation

reroute_incidentsReroute incidentsPOSTReroutes one or more incidents to other users or escalation policies. addTargets (Enterprise accounts only) keeps the current targets and requires a response from each one before paging stops.

Routing key, 1 operation

list_routing_keysList routing keysGETLists the routing keys of the organization and the escalation policies (with their teams) each one targets.

Scheduled, 1 operation

get_shift_scheduled_userGet shift scheduled userGETGets the user currently scheduled on call for a rotation shift.

Send message, 1 operation

send_stakeholder_messageSend stakeholder messagePOSTSends a stakeholder message about an incident to users and teams: a title and a message. At least one recipient, a user or a team, is needed.

Start, 1 operation

start_maintenance_modeStart maintenance modePOSTStarts maintenance mode for a list of routing keys (an empty list means global maintenance mode), with a purpose. Only one global maintenance mode can be active at a time.

Webhook, 1 operation

list_webhooksList webhooksGETLists the outgoing webhooks configured in the organization's Webhooks integration, with each one's slug and label. The destination URL is not returned, as it can embed a secret.

Use Splunk On-Call (VictorOps) from Claude Code, Cursor or Codex

Connect Splunk On-Call (VictorOps) in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Splunk On-Call (VictorOps) operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Splunk On-Call (VictorOps)

Create your workspace
Sign up free. Nothing to install.
Connect Splunk On-Call (VictorOps) once
Add your Splunk On-Call (VictorOps) connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.