Splunk Enterprise Security

Add-on for Atlassian JIRA Service Desk alert action : Jira ticket creation from Splunk failed

sdivya
Observer

Hi, 
i m getting the below error when i m trying to create a ticket from splunk. i m passing this value in custom field:
"customfield_12345":{"value":"$result.myfield$"},"customfield_17653":"$result.mytime$","customfield_10678":{"value":"$result.urgency$"},"customfield_19876":{"value":"$result.severity$"},"customfield_18754":{"value": "$result.reporting$"}

The error is as follows:
ERROR pid=1413 tid=MainThread file=cim_actions.py:message:424 | sendmodaction - worker="abc.com" signature="Unexpected error: Expecting property name enclosed in double quotes: line 15 column 2 (char 463)." action_name="jira_service_desk" search_name="test_jira"

and other error  is 

ERROR pid=1413 tid=MainThread file=cim_actions.py:message:424 | sendmodaction - worker=" abc.com " signature="json loads failed to accept some of the characters, raw json data before json.loads:={

"fields": {

"project":

 {

"key": "def"

 },

"summary": "def_test",

"description": "The alert condition for 'def_test' was triggered, results link: 'https://abc.com/ app/TA-jira-service-desk-simple-addon/@go?sid=scheduler_c2YXJ0di5jb20_VEEtaRlc2stc2ltcGxlLWFkZG9u__RM331f78_at_1593419940_82'",

"issuetype": {

"name": "abc"

},

 "priority" : {

"name": "Medium"

 },

 \"customfield_12345\":{\"value\":\"hello"},\n\"customfield_17653\":\"2020-06-27T10:29:29.908+1100",

\"customfield_10678\":{\"value\":\"Low"},\n\"customfield_19876\":{\"value\":\"High"},\n\"customfield_18754\":{"value": "API"}

 

}

}" action_name="jira_service_desk" search_name="test_jira "


Any suggestions...

Labels (1)
Tags (1)
0 Karma

BamBamMantell
Observer

On the Jira App there is an option for custom fields passing. Enable that.

enable_field_passing.png

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...