As per https://answers.splunk.com/answers/691950/splunk-add-on-for-atlassian-jira-alerts-is-failing.html I added verify=False, but also had to remove proxies=proxy and then the health check stopped report errors. But any attempt to use the Jira app to create a ticket failed; Splunkd.log shows:
10-14-2018 23:00:04.159 +0000 INFO sendmodalert - action=jira STDERR - Jira server HTTP status= 401
10-14-2018 23:00:04.159 +0000 INFO sendmodalert - action=jira STDERR - Jira server response:
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - <html>
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - <head>
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - <title>Unauthorized (401)</title>
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR -
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - <!--[if IE]><![endif]-->
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - <script type="text/javascript">
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - (function() {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - var contextPath = '';
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - var eventBuffer = [];
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - function printDeprecatedMsg() {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - if (console && console.warn) {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - console.warn('DEPRECATED JS - contextPath global variable has been deprecated since 7.4.0. Use `wrm/context-path` module instead.');
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - }
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - }
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - function sendEvent(analytics, postfix) {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - analytics.send({
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - name: 'js.globals.contextPath.' + postfix
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - });
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - }
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - function sendDeprecatedEvent(postfix) {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - try {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - var analytics = require('jira/analytics');
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - if (eventBuffer.length) {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - eventBuffer.forEach(function(value) {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - sendEvent(analytics, value);
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - });
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - eventBuffer = [];
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - }
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - if (postfix) {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - sendEvent(analytics, postfix);
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - }
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - } catch(ex) {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - eventBuffer.push(postfix);
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - setTimeout(sendDeprecatedEvent, 1000);
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - }
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - }
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - Object.defineProperty(window, 'contextPath', {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - get: function() {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - printDeprecatedMsg();
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - sendDeprecatedEvent('get');
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - return contextPath;
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - },
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - set: function(value) {
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - printDeprecatedMsg();
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - sendDeprecatedEvent('set');
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - contextPath = value;
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - }
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - });
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - })();
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - </script>
10-14-2018 23:00:04.160 +0000 ERROR sendmodalert - action=jira STDERR - <script>
When I set the Jira creadentials via Apps-Manage Apps->"JIRA Custom Alert Action : Ticket Creation"->Setup, the only related file I see being touched is etc/apps/splunk-add-on-jira-alerts/local/alert_actions.conf, which contains all the credentials set except the password. Where might that be stored - and if it was stored correctly why is the use failing to authenticate. We have manually built a curl command that uses the values in jira.py and it works as expected when run from the command line.