Trouble Retrieving Events in Splunk from Jira Integration: Need Help

[Ana_Smith1]

Hello everyone,

I'm facing challenges with integrating Splunk and Jira using the Splunk Add-on for Jira Cloud. I've set up a new input using a token from an admin account and created an indexer to centralize the data. However, despite these configurations, I am unable to retrieve the events as expected.

I have verified that the token is valid and have ensured the input configurations in Splunk are correct, but nothing seems to work properly. The Jira admin account has the necessary permissions to access the required events, yet no data is being collected in Splunk.

I am seeking advice or suggestions on what might be causing this issue. If anyone has encountered similar problems or has ideas on steps to resolve this, I would greatly appreciate your insights.

Thank you in advance for your help!

[livehybrid]

Hi @Ana_Smith1 

Do you get anything in the _internal logs from the add-on? Try something like the below as a starting point:

index=_internal (ERROR OR WARN) "jira"

This search will help identify any issues related to the Jira integration.

Verify Network Connectivity: Ensure there's no network issue preventing Splunk from connecting to Jira. Check firewall rules and proxy settings if applicable. Are you running Splunk on-prem or Splunk Cloud?

Test Jira API Connectivity: Use a tool like curl to test the Jira API connectivity using the token. This will help determine if the issue is with the token or the Splunk configuration.

curl -u youremail@example.com:your_api_token https://your-company.atlassian.net/rest/api/3/myself

For more detailed troubleshooting steps and configuration guidelines, refer to the Splunk Add-on for Jira Cloud documentation.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Ana_Smith1]

I ran the following search in Search & Reporting: index=_internal (ERROR OR WARN) "jira".
This returned 3 significant errors related to the API token. I’m unsure where I can find the file that contains the API token for Jira in Splunk. i am working in splunk cloud environnement.
I’ve attached screenshots of the errors for reference. Any help would be greatly appreciated!
Thank you in advance.

[PaulPanther]

Do you use the Splunk Add-on for JIRA on a Splunk Enterprise instance or in your Splunk Cloud env?

Have you verified the network connectivity?