Splunk Jira Issue Input Add-on: How do I return all JQL fields needed for incident reporting?

millan — Thu, 06 Aug 2026 20:30:49 GMT

I am configuring the Jira Issue Input Add-on to ingest enterprise security incidents into Splunk using a JQL query.

The JQL returns the correct Jira issues, but I need to confirm how the add-on determines which issue fields are returned and indexed in Splunk.

The dashboard requires fields such as:

Jira issue key
Project
Issue type
Summary
Description
Created
Updated
Status
Resolution
Priority or severity
Assignee
Reporter
Labels
Components
Hostname or device information
Customer Request Type
org dept information
Other Jira custom fields

Questions:

Does the add-on ingest all fields returned by the Jira REST API, including custom fields?
Is there a configuration where specific Jira fields must be listed?
Does the JQL only control which issues are returned, or does it also control the fields returned?
How are Jira custom fields represented in Splunk, for example customfield_12345?
Is there a recommended way to map Jira custom field IDs to readable Splunk field names?
Does the add-on support historical backfill using the same JQL query?
Is there a sample event or field extraction example showing the expected JSON structure?

The JQL is similar to:

( ( project = "ORG IT Support" AND "Customer Request Type" = "Security Alert (ORGIT)" ) OR project = "Security Operations Center" ) AND ( description ~ "ORG" OR summary ~ "\"Manhattan Dept \"" OR summary ~ "\"Hackensack Dept\"" ) ORDER BY created DESC

The goal is to replace a static CSV lookup with Jira data retrieved through the REST API and use the indexed issues for incident totals, monthly trends, City & Dept counts, device mapping, and detailed incident reporting.

Environment:

Splunk Enterprise
Distributed deployment
Jira collection expected to run from a Heavy Forwarder
Jira Issue Input Add-on
Jira REST API
Dashboard Studio

Any configuration examples for the modular input, source, sourcetype, JSON field extraction, and custom-field handling would be helpful.

Suggested tags:

jira
jira-add-on
modular-input
rest-api
jql
heavy-forwarder
field-extraction
dashboard-studio

topic Splunk Jira Issue Input Add-on: How do I return all JQL fields needed for incident reporting? in Other Usage

Splunk Jira Issue Input Add-on: How do I return all JQL fields needed for incident reporting?