Report a potential Splunk Cloud Platform service failure

Splunk monitors key performance indicators to identify problems or failures within a cloud service provider (CSP) region and proactively run failovers in case of a problem that causes significant degradation in the Splunk Cloud Platform service. It's likely that Splunk Support has noticed the problem and already begun procedures to fix it.

If you believe that key Splunk Cloud Platform functionality is unavailable for an extended period of time, at least 30 minutes, you can ask Splunk Support to investigate and to possibly failover your Splunk Cloud Platform deployment.

To report a potential service failure, follow these steps:

1. Visit the Splunk Support Portal.
2. File a priority one (P1) support case.
3. In the ticket, indicate that you believe that Splunk Cloud Platform functionality is nonexistent or severely degraded.

Splunk uses the following scenarios to determine that Splunk Cloud Platform functionality has been lost. Confirm that they exist before submitting a case:

• Data ingestion through Splunk Forwarders or HTTP Event Collector (HEC) inputs is blocked
• Indexing is blocked
• No one can login to Splunk Cloud Platform
• Splunk can confirm a failure with the cloud service provider

Sometimes, this loss of functionality might not be related to a regional CSP failure, and failover to the secondary site might not recover the functionality. After you file the support case, Splunk Support processes the ticket and determines whether to declare a qualified regional disaster event and run a failover to recover your production Splunk Cloud Platform environment.