As part of the event management / incident management activities being carried out, it would be great to be able to create an incident during a recovery action execution. Then splunk would identify the incident creation and link it with the triggering episode, instead of Splunk creating the incident.
This would enable us to run more complex troubleshooting actions, redirecting the ticket automatically to the proper group when necessary (ie hoststatus idle episodes).
A clarification call with the customer is required before moving this into the backlog.