All Apps and Add-ons

Add-on for Atlassian JIRA Service Desk alert action: Getting errors and components are required when alert is triggered in the logs.



We have an issue where when we set up the alert action we put all the required fields with the red *. We trigger the alert and in the logs, we see that it is requiring the content: components.

"fields": {
        "issuetype": {
            "name": "Task"
        "priority": {
            "name": "High"
        "summary": "Splunk Alert:  Alert", 
        "project": {
            "key": "id "
        "description": "The alert condition for ' Alert' was triggered."
}, **HTTP Error=400, content={"errorMessages":[],"errors":{"components":"Components is required."}}**"

In custom fields we put a component and we triggered the alert and we got a different error :

 \"content\": {\"component\": { \"name\": \"Incidents"} }

}" **action_name="jira_service_desk" search_name="CrowdStrike Detection Alert"  signature="Unexpected error: Expecting property name enclosed in double quotes: line 15 column 2 (char 257)."** 

Can you please Advise?


Labels (2)
0 Karma


Hi @amksa

Hum right, I will need to perform some verifications, can you confirm that the message:

HTTP Error=400, content={"errorMessages":[],"errors":{"components":"Components is required."}}

Is returned by JIRA ? This might indicate effectively a required field maybe for the tasks or in respect with your JIRA fields configuration.

The custom field section is meant to be used for proper custom fields only, this shouldn't apply for non custom fields.


0 Karma


So @amksa

I could re-reproduce this, by default the field "Components" is an optional field in JIRA, not required.

But certainly your JIRA admin has defined this field to be mandatory, which is why the creation is failing with the following message:

Components REQUIRED
[Autocomplete Renderer

}, HTTP Error=400, content={"errorMessages":[],"errors":{"components":"Components is required."}}"

I am checking if how this can be managed.


0 Karma



Please upgrade to the version 1.0.8 of the add-on, that was published on Splunk Base.

This version will allow you to define the Components field in the custom field section, without its section to be managed as characters to be protected. (the reason why it failed when you attempted to do so.)

Assuming your JIRA admins allowed the field to be defined in the screens, and you input values format accepted by your JIRA, this will fix your issue.

Let me know if any further issue.


0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...