Update in Splunk when an incident is closed in Jira

[Gariito]

Hi,

Firstly, thank you for the work on this addon and thanks the community that is solving problems helping each other.

We have a Splunk Cloud that we want to connect with Jira using this addon.

The idea we have is to send to Jira all the tickets that will create Splunk and manage them in Jira. When the ticket is closed in Jira, we want to update all the information, comments and updates in the ticket to visualize them in Splunk.

Any ideas or URL that would help us configuring this function? Maybe with webhook?

Thank you so much,
Kindest regards.

P.S: Sorry about my english, it is not the best 🙂

[livehybrid]

Hi @Gariito 

There are a couple of ways you could get the data from Jira back in to Splunk - I think one of the most effective ways would be to use the Jira Webhook configuration (https://support.atlassian.com/jira-cloud-administration/docs/manage-webhooks/) as this will trigger when changes are made. 

You can configure Jira to send the webhooks to your Splunk Raw HEC endpoint in Splunk Cloud and then create a search/dashboard to visualise this information.

Another option would be to use an app such as Jira Issue Input Add-on however this requires writing a JQL statement to pull in specific issues, which can result in delays and duplication of events.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Gariito]

Hi livehybrid,

Thank you for your response, we are going to work with webhooks.

Having a splunk cloud, we are trying to create the URL for our HEC token to configure it in the webhook of Jira.

We are not sure how we have to configure the URL with the tokens. As far as i know it is not recommended to put the hec token in the URL and even if that was the answer, we are not sure how to put it.

If we have more than 1 HEC in Splunk, we have to specify the token somehow no? There could be a kind of miss between tokens if we dont specify? Example of HEC Url.

"https://http-inputs-mycompany.splunkcloud.com/services/collector/event"

Kindest Regards