Jira & Splunk - Field Extractions are a bit Whack

[Mike Elliott]

Hi Team,

I posted this issue on Splunk answers, but thought I should come here and seek some assistance from the pros!

https://answers.splunk.com/answers/739616/jira-add-on-issues-with-extractions.html

In summary, we're looking to pull key MI data from Jira at the end of every month into Splunk, and then have Splunk do some of it's magic to make it all look nice, etc.

The issue I'm having is that the JSON data being passed from Jira to Splunk isn't being seen as JSON data by Splunk.  Splunk is then extracting some fields, but not others or just not extracting at all (screenshots are in the Splunk Answers thread).

Has anyone got any particular experience in this area, and if so, could you point me to the resources you used to overcome these issues?

Any assistance would be very much appreciated!

Kind regards,
Mike

[Fergal Walsh]

Hi @Mike Elliott

I think I have a simple workaround for this. I used the Splunk add-on "Rest API Modular Input" to poll data from Jira rest api's earlier this year. I found it extracted and indexed all key value pairs from the JSON response data perfectly, which allowed to do all the splunk magic I needed. Give it a try and see if it works.

You can download the add-on here:  https://splunkbase.splunk.com/app/1546/
After installation you will find it residing in the Data Input section in your Splunk settings.

Regarding the problem you experienced with the Jira add-on, I never used it so I cannot say much. But assuming the add-on works for other users, I would advice you to check the permissions assigned to Jira add-on in splunk. It may not be not be able to read/write to the props.conf file.

Regards,

Fergal