All Apps and Add-ons

Can the Add-on for JIRA be enhanced to return the actual start datetime for the timespent entry type?

scdrill
New Member

The only datetime we get from changelog timestamp entries is the created data, which does not necessarily correspond to the time interval being recorded. We are trying to get very accurate work logging, at least by date, for software capitalization accounting.

0 Karma
1 Solution

Flynt
Splunk Employee
Splunk Employee

Unfortunately the return from the API (using expand) does not include this field . However the beauty of Splunk is you probably don't need it. You could use a join in Splunk to get the changelog AND all the event fields. For example if I had an issue called TEST1 - I could use a search like this

|jira changelog "key=TEST1" |table *|join key [|jira jqlsearch "key=TEST1"|rename Key as key]|table *

**Important, the rename Key as key is necessary because changelog and jqlsearch returns key in in different cases. Without this rename, the join will fail and you will get no results.

This search will return ALL fields from the records. If there are particular fields you want to return, use the fields option and the native JIRA fields you require in a comma separated list. For instance if my starttime field was natively called custom1234 in JIRA.

|jira changelog "key=TEST1" |table *|join key [|jira jqlsearch "key=TEST1" fields "custom1234"|rename Key as key]|table *

To request multiple fields - say I wanted my starttime (custom1234) and the description

|jira changelog "key=TEST1" |table *|join key [|jira jqlsearch "key=TEST1" fields "custom1234,description"|rename Key as key]|table *

Hope this helps!

View solution in original post

Flynt
Splunk Employee
Splunk Employee

Unfortunately the return from the API (using expand) does not include this field . However the beauty of Splunk is you probably don't need it. You could use a join in Splunk to get the changelog AND all the event fields. For example if I had an issue called TEST1 - I could use a search like this

|jira changelog "key=TEST1" |table *|join key [|jira jqlsearch "key=TEST1"|rename Key as key]|table *

**Important, the rename Key as key is necessary because changelog and jqlsearch returns key in in different cases. Without this rename, the join will fail and you will get no results.

This search will return ALL fields from the records. If there are particular fields you want to return, use the fields option and the native JIRA fields you require in a comma separated list. For instance if my starttime field was natively called custom1234 in JIRA.

|jira changelog "key=TEST1" |table *|join key [|jira jqlsearch "key=TEST1" fields "custom1234"|rename Key as key]|table *

To request multiple fields - say I wanted my starttime (custom1234) and the description

|jira changelog "key=TEST1" |table *|join key [|jira jqlsearch "key=TEST1" fields "custom1234,description"|rename Key as key]|table *

Hope this helps!

scdrill
New Member

Thanks Flynt. I had tried the back join to the events but I didn't know that "table *" trick. Now I can see what's going on and it's a case of Jira using the same field to hold both relative and absolute datetimes. Splunk IS a beauty!

0 Karma

Flynt
Splunk Employee
Splunk Employee

Excellent! If the fields overwrite each other because of the join, try renaming the field in one of the searches to something else. Glad you are getting what you need!

0 Karma

scdrill
New Member

Well, I thought I was good, but even in all those fields the actual changelog timestamp is not available. A get through the API will return the field like:

...
"comment":"",
"created":"2015-08-03T20:48:15.000+0000",
"updated":"2015-08-03T20:48:15.000+0000",
"started":"2015-07-25T19:45:00.000+0000",
"timeSpent":"45m",
"timeSpentSeconds":2700,
"id":"64141"
},

when expand='changelog' is an argument. That is the only field that contains this data.

0 Karma

Flynt
Splunk Employee
Splunk Employee

Aha! I see the issue! And indeed it is my code, I apologize for the confusion. I can work with you offline if you wish to add these in (you can send me a mail) and I'll make sure they get added into the next iteration.

0 Karma

scdrill
New Member

Very cool. I don't see your email but you should be able to see mine: steve.drill@resonate.com

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...