Hi jb_spelunker, does this help? ... View more

According to log file, it looks like you haven't specified what fields you want to get in inputs.conf, please do this if you want to get all fields return by payload: [jira://splunk] ... fields = * ... ... View more

Could you paste detailed exception log? i.e what HTTP error code does it return? etc. ... View more

bin/libs/modinput_wrapper/base_modinput.py:46 try: self.setup_util_module = importlib.import_module(self.namespace + "_setup_util") except ImportError as ie: self.logger.info("Can not import package:" + self.namespace + "_setup_util") I believe it's safe to remove that code since the app doesn't define the setup_util. ... View more

Hey jb_spelunker, There are 2 issues here: 1. INFO pid=36306 tid=MainThread file=base_modinput.py:init:51 | Can not import package:libs_setup_util This Add-on use Add-on builder but it didn't define the setup_utils libary. However, this is just INFO log and it shouldn't affect anything nor the second issue. 2. ERROR pid=36306 tid=MainThread file=base_modinput.py:log_error:70 | Get error when collecting events. I couldn't find any clue from this partial log. Could you post more detail? As you described, live query | jira works so the connection between your Splunk instance and JIRA server is good. How does your JQL which is defined in inputs.conf look like? Does it a massive query which returns too many records? I know some JIRA administrators define some policies against REST API query. If it is the case, try using queries which returns small amount of data. ... View more

You'll set your server info for: - config.ini: If you want to do live query with | jira command. - inputs.conf: If you want to index your jira data There is no server info in jira.conf ... View more