Skip to main content

​
Overview

Create sub-incidents directly from an incident’s Slack channel using Rootly slash commands.
Sub-incidents help teams split large or cross-functional incidents into focused workstreams while keeping everything tied back to the parent incident.

​
Restrictions

Sub-incident creation is only available when:
  • You run the command inside an incident channel
  • The incident is not already a sub-incident
  • You have permission to create incidents
  • The incident has no restrictions (e.g., cannot split a sub-incident)
If these conditions are not met, Slack will show an appropriate error.

​
How to Create a Sub-Incident in Slack

​
1. Run the sub-incident command

In the parent incident channel, type any of the following: 
/rootly sub
/rootly split
/rootly fork
/rootly swimlane
These commands all trigger the Create Sub-Incident dialog.
Sub-incident Slack dialog

​
2. Complete the creation dialog

Fill in the incident fields as you normally would.
Rootly automatically links the new incident as a sub-incident of the channel you ran the command from. After submitting, Slack will confirm that the sub-incident has been created:
Sub-incident created confirmation
You’ll then see a reference to the new sub-incident in the parent incident’s summary, Slack channel, and web interface.

​
What Happens Behind the Scenes

Rootly automatically:
  • Sets the new incident’s parent_incident_id
  • Assigns a sub-incident kind (e.g., normal_sub, scheduled_sub)
  • Attributes the creation to Slack
  • Optionally creates a Slack channel for the sub-incident (team settings apply)
  • Triggers any workflows conditioned on
    Kind → is one of → normal_sub / scheduled_sub / test_sub
Sub-incidents created via Slack behave exactly the same as those created in the Web UI.
They inherit parent properties depending on your workspace configuration and feature flags.

​
Demo

​
Best Practices

  • Use sub-incidents to divide ownership across SRE, Security, Networking, or other teams.
  • Keep the parent incident customer-facing while sub-incidents track internal or deep-dive workstreams.
  • Use workflows to automate structure, such as creating roles or tasks for each new sub-incident.
  • Name sub-incidents clearly to reflect their specific investigative track.
  • Avoid splitting unless the scope is meaningfully distinct—small tasks are usually better captured as action items.

​
Troubleshooting

Slack restricts /rootly sub to incident channels only.
Run the command inside the relevant incident channel.
Sub-incidents cannot be split further.
Create sub-incidents from parent incidents only.
Your role does not have permission to create incidents.
Contact your Rootly admin to update your permissions.
This may occur if:
  • Required fields were left blank
  • Your Slack integration is temporarily disconnected
  • Your team has restricted sub-incident creation via feature flags
Ensure that:
  • The originating channel was the correct parent incident channel
  • The parent incident is not archived or cancelled
  • The sub-incident was created successfully (Slack will show a confirmation)