All Apps and Add-ons

Add-on for JIRA: Is there a character limit in jirarest jqlsearch?

leonphelps_s
Path Finder

This is the search I am trying to execute from within Splunk:

| jirarest jqlsearch "text ~ "20160721163457215194133559""

I just want to find that # in JIRA..

The result from that command is HTTP Error 400: Bad Request (Jira Exception)

If I shorten that request to (19 characters, no more)

| jirarest jqlsearch "text ~ "2016072116345721519""

It returns "No results" presumably because there aren't any. For the sake of testing.. I added the 19 character # to a jira case and re-ran the query.

It returned the appropriate single row.. the full details of the jira case with both the original and long version of the #.

Ideas?

1 Solution

leonphelps_s
Path Finder

So I realized that I needed to escape the inner quotes as follows.

| jirarest jqlsearch "text ~ \"20160721163457215194133559\""

This returns the appropriate results, however, it is still unclear to me why the 19 character version without escaping the quotes worked.

View solution in original post

leonphelps_s
Path Finder

So I realized that I needed to escape the inner quotes as follows.

| jirarest jqlsearch "text ~ \"20160721163457215194133559\""

This returns the appropriate results, however, it is still unclear to me why the 19 character version without escaping the quotes worked.

Flynt
Splunk Employee
Splunk Employee

Looks like you found the issue here pretty quickly. You should escape quotes within the query if your JQL search requires them.

Note that if your text ~ statement is only one word (not a number!, see below comment) with no spaces, you shouldn't need quotes there at all.

| jirarest jqlsearch "text ~ SOMELONGSTRING"

Should work the same. If you have spaces in the criteria, then yes, you will need the escaped quotes.

**Edited for clarity

0 Karma

Flynt
Splunk Employee
Splunk Employee

I suspect this has something to do with the number converting to scientific notation when it is larger. If you are using alphanumeric characters it works fine.

When the number is converted to scientific notation it will contain a "+" which will confuse the API query syntax.

Note that for this search

|jirarest jqlsearch "project=foo key=bar"

gets translated as

project%3Dfoo+key%3Dbar

So with the number being in scientific notation it would cause the API to see that extra "+" which would invalidate the request.

In this case the underlying python script sees the query

 | jirarest jqlsearch "text ~ "20160721163457215194133559""

as

text+%7E+20160721163457215194133559

which gets decoded to

 text ~ 20160721163457215194133559

and is most likely presented to the API as

text+%7E+2.0160721163457216e+25
0 Karma

leonphelps_s
Path Finder

attempting it without the quotes does not work, presumably because of the additional information you just added. The quotes forces the issue I suppose and looks for the exact string.

Flynt
Splunk Employee
Splunk Employee

Yes you are correct, without the quotes it will convert it just the same. My example is poor when using a number and not a string. I've edited the answer accordingly

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...