topic Jirarest add-on returning a subset of results in Splunk Search

Jirarest add-on returning a subset of results

SplunkIsLife — Mon, 11 Dec 2017 16:35:40 GMT

I'm using the Jirarest add-on in the following way, passing through a specific search (sometimes with changelog):

| map
 [| jirarest jqlsearch "$jiraSearch$"
| eval something ] maxsearches = 100

But am getting inconsistent results. Sometimes I get every Jira log that was hit (comment, change, created) and sometimes it just completely misses logs. I thought this could be due to a splunk forwarder issue but it seems this is independent of that. Has anyone experienced this inconsistency/have any ideas as to why it might be happening or how to fix it?

Re: Jirarest add-on returning a subset of results

DalJeanis — Mon, 11 Dec 2017 20:46:03 GMT

What are the values of the field jiraSearch that you are passing? Chances are pretty good that there is a problem in the escaping or formatting of the search itself.

Re: Jirarest add-on returning a subset of results

SplunkIsLife — Mon, 11 Dec 2017 21:35:12 GMT

I'm not sure that's the problem, given that it works perfectly some of the time. It follows the format of Jira filters like "filter in ('".filter."') AND Created>=-14d" etc.