Create Jira Ticket using Splunk Alerts (via 3rd Party App)

[AKG1_old1]

Hi,

we are trying to create JIRA tickets via Splunk alerts.

I have installed "Splunk Add-on for Atlassian JIRA Alerts"
https://splunkbase.splunk.com/app/2888/#/details

In our case we can't directly create JIRA tickets, there is one 3rd Party app, which accept input in JSON format. Not sure if its possible to implement.

Request Format which require to Create JIRA via 3rd Party APP.

Please find below the details needed to create jira issue for TI project:
-   URL: http://***/jiratst/projects/TI/issues
-   Method: POST
-   Credentials as Basic Authentication:
-   Username/Password: ***/***
-   Body
    {
      "summary": "Test to create TI issue from mule",
      "description": "Mule Testing Jira Api one level of Module",
      "type": "Incident",
      "priority": "3-Medium",
      "reporter": "ag",
      "moduleMapLevels":{"parent":"Common to All Modules"},
      "moduleMapAssets": [{"name":"Rates | IRD"},{"name":"CRD | CRD"}]
    }

I have setup JIRA alert with these details.

When alert is triggered I am reciving this error in splunkd.log

03-13-2019 13:19:12.069 +0100 INFO  sendmodalert - action=jira STDERR -  Jira server HTTP status= { "message": "Resource not found" }
03-13-2019 13:19:12.069 +0100 INFO  sendmodalert - action=jira STDERR -  Jira server response: { "message": "Resource not found" }

Thanks

[michaeltayo]

Does this JIRA ALERT add on, work with JIRA cloud ? or is it just ON Prem?

[guilmxm]

@michaeltayo For both as long as basic authentication (user name and secret token) is allowed.
It used the JIRA rest API: https://developer.atlassian.com/server/jira/platform/rest-apis/

[guilmxm]

As I had the occasion to work intensively on JIRA, and due to the lack of support and maintenance of this old addon, I created and pushed a brand new add-on which advantageously replaces it:

https://splunkbase.splunk.com/app/4958/

[Paul1896]

As everybody knows the current Add-On version is not supported for version 7 & 8. I found this "idea" (https://ideas.splunk.com/ideas/DTID-I-1) in the splunk idea pool. Feel free to upvote it.

[mlucas01]

In these responses it appears the add-on Splunk Add-on for Atlassian JIRA Alerts is NOT compatible with Splunk version 7.

Are you guys saying that this is a "no go" for version 7 OR there is a work around. I've obtained the requirement, from Splunk support, that the JIRA user must have the permission admin_all_objects for the ticket creation to work within JIRA.

Any updates much appreciated! I'm going to give this add-on a try on our splunk version 7.

[amitpanjawani]

Not sure if you have already solved this or not but I am having a different issue with this Add-on, so I'm writing my own and will release it soon.

Few basic troubleshooting steps:

1) Try to create JIRA manually using any other application or even chrome browser extension like Postman.
2) Check if the user you are using has the right/permission to create the ticket.
3 and the main) Check if your organization allows the request with SSL_Certificate validation = False as far as I know, this add-on has disabled SSL Validation.
4) If not you can remove the disable part from the script and add your certificate path instead to verify.

With all these checks, I think you would be good to go.

[jayasatyaallapa]

I think Jira 3rd party app is not working after 6.6..

what version of splunk you are using ?? and even I got the same problem.

[AKG1_old1]

I am using v7.1.6

[jayasatyaallapa]

Yes Agoyal, it is no more supported for splunk after 6.5.. It won't work in splunk 7.

you can see the supported versions in splunk base for that app.

Thanks,

[AKG1_old1]

@jayasatyaallaparthi: thanks for information. Just to be clear. it won't support only via 3rd party app or it's not going to support at all ?

If I will try to raise ticket directly to JIRA, will it work ?

[jayasatyaallapa]

I don't think so.. cause they should develop the app and need to get the approval from splunk.

It's long long process. Try raising the ticket to JIRA..But contact splunk before doing that.. It will help all of us..:)