Splunk On-Call (VictorOps) alternatives: pros, cons and how to move

Splunk On-Call, formerly VictorOps, is a capable paging tool: routing keys send alerts to team escalation policies, rotations decide who is on call, and a rules engine annotates and transforms alerts before they page anyone. Newer incident response platforms keep that paging and add what happens after it: incidents that run in Slack, Microsoft Teams or Google Chat, workflows that open channels, bridges and tickets, status pages, and AI-drafted retrospectives. Splunk has not announced an end-of-life date for On-Call, so the reason to move is what your team needs after the page, not a deadline.

This guide lists Splunk On-Call’s strengths and gaps against newer platforms, and how to move without a gap in paging.

Splunk On-Call compared with newer incident response platforms

Capability	Splunk On-Call	Newer platform (Rootly)
Alert routing	Routing keys to team escalation policies	Alert routes to teams, services or escalation policies, by source and field
Alert processing	Rules engine: annotations, routing key changes, field additions, muting, aggregation	Alert routing rules, deduplication, grouping and alert workflows
On-call	Team schedules, rotations, escalation and paging policies	Schedules and rotations with overrides, shift swaps and shadowing; escalation policies
Paging	Push, SMS and phone	Push (including critical push that bypasses Do Not Disturb), phone, SMS, email, Slack and Microsoft Teams
Chat	Slack and Microsoft Teams integrations	Native incident workflow in Slack, Microsoft Teams and Google Chat
Incident coordination	Incident timeline and team collaboration	Incident channels, roles, workflows, Zoom or Google Meet bridges, Jira and Linear tickets
Status pages	Separate tool or integration	Included with Incident Response
Retrospectives	Reporting on incident data	AI-drafted retrospectives from the timeline, published to Confluence, Notion or Google Docs
Configuration as code	Terraform provider and REST API	Terraform provider, Pulumi, REST API and CLI
Splunk stack	Native ITSI integration and Splunk app	Rootly Splunk app for saved search alerts; Rootly AI connects to Splunk for investigation

Splunk On-Call pros and cons

Pros

• Mature paging: routing keys, team escalation policies, rotations and paging policies cover most on-call setups.
• The rules engine annotates alerts with links, images and notes, and transforms them before routing.
• Bidirectional integration with Splunk ITSI Event Analytics for teams invested in Splunk.
• Terraform provider and REST API for managing users, teams and escalation as code.

Cons

• Paging-first. The incident itself (channel, roles, bridge, tickets, stakeholder updates) needs other tools or manual steps.
• Chat is an integration rather than the place the incident runs.
• Status pages and retrospectives sit outside the product.
• Strongest inside a Splunk stack. Teams whose signals come mostly from Datadog, Grafana or cloud monitoring get less of its value.

How to move from Splunk On-Call

1. Connect both tools. Install Rootly’s VictorOps (Splunk On-Call) integration. Rootly can then create, update and resolve linked Splunk On-Call incidents and page Splunk On-Call teams from Slack while paging still runs there.
2. Run incidents in Rootly first. Declare and coordinate incidents in Slack, Microsoft Teams or Google Chat with Rootly, and let Splunk On-Call keep paging. Responders get the incident workflow without changing who wakes up.
3. Recreate on-call. Map rotations to schedules, team escalation policies to escalation policies, and routing keys to alert routes. Define them in Terraform to keep the mapping reviewable.
4. Point alerts at Rootly. Send monitoring alerts to Rootly alert sources. Splunk Enterprise and Splunk Cloud saved searches forward alerts through the Rootly Splunk app, and its alert actions can page Rootly on-call targets directly.
5. Move paging team by team. Run both for a week per team with test pages, then switch that team’s routing to Rootly.

How teams run Rootly with a Splunk stack

Splunk stays the source of logs and signals: saved search alerts reach Rootly as alerts, alert workflows decide which ones open incidents, and Rootly AI can query Splunk during an investigation through the Splunk connector. Rootly’s On-Call handles schedules, escalation and paging, and Incident Response runs the incident natively in chat. A first incident runs in about 15 minutes with starter templates and defaults, and most teams are live within a week. See pricing for both products.