In my case it is about:   @PickleRick wrote: In case of a downed indexer(s) Splunk is warning you that it might not have all the data it should have. And it makes sense because the missing indexers could have had buckets which have not been replicated yet or might have been replicated but are not searchable. I want my search to not store the data in a lookup when Splunk raises this warning. And here I'm stuck.    ... View more

The search can return anything between 0 and something but that is not my question. I cannot judge the quality of the received data by its quantity. It is just important that I receive all the data I'm asking for. Again, my question is, is there a way to detect if a search is dealing with partial results. As a user you been notified when you run the search manually. This I want to detect in the search itself. I will experiment with appendpipe. ... View more

Hope it did not mention partial search 😉 I share the concern regarding subsearches with you, maybe appendpipe could help ... This is a challenge for me, I should not update the lookup when the search is seeing partial results. It happens very rarely, maybe doing it differently could help. Sorry, I hopped there is something in SPL that would tell me that the search results are kind of limited. require is a very good hint!   ... View more

I could not hold may horses and started to work on a design to make this work with Splunk ITSI as well. One thing is that the parameters needs to be flexible by the result returned by the Episode. So no dropdown lists. I also want this to work bidirectional to have Jira issue updates being reflected in the Episode like it is with the ServiceNow integration. This is partly working by loading the issue/request updates into a jira_pub index and havin a bidirectional ticketing correlation search updating Episodes. Note that the sourcetype needs to be tweaked to snow:incident to not confuse the backfill search in ITSI. Beside this a issue/request is created by id via the  Jira servicedesk api only so I created another alert action based on your alert action. I named it modalert_jira_service_request_helper.py. and added an alert action stanza to alerts.conf. Instead of performing three rest calls, one for the project id, one to get the issue type id and then finally creating the request I instead load all projects into a pub index named jira_pub. This one is then updated once an hour, this reduces the number of rest calls towards Jira. Getting the projectKey from that index I do it like this (might be nicer ways in doing it): # common_pub is used for testing, in production projects are loaded into jira_pub spl={} spl['search']="search index=common_pub projectKey="+jira_project+" earliest=-120m | head 1 | fields id" spl['output_mode']="json" spl['exec_mode']="oneshot" record_url = 'https://localhost:' + str(splunkd_port) \ + '/services/search/jobs/export/' headers = { 'Authorization': 'Splunk %s' % session_key, 'Content-Type': 'application/json'} response = requests.post(record_url, headers=headers, verify=False, data=spl) helper.log_debug("search response status_code:={}".format(response.status_code)) jira_search_response = response.text jira_search_response_json = json.loads(jira_search_response) helper.log_debug("search response:={}".format(jira_search_response_json)) jira_project_id=jira_search_response_json['result']['id'] try: if jira_project_id is None: # The variable helper.log_info("No project id found in index jira_pub for project name={}".format(jira_project)) return 0 except NameError: helper.log_info("No project id found in index jira_pub for project name={}".format(jira_project)) return 0 helper.log_debug("Found id:={}".format(jira_project_id)) # servicedesk id for request payload data['serviceDeskId'] = jira_project_id # add project as servicedesk id to url jira_issues_url=jira_url+'/servicedesk/'+jira_project_id+'/requesttype'   Whats missing is to add the itsi_group_id as correlation_id to the issue/request. Maybe this goes into a custom field in Jira. Another thing is to update itsi_notable_event_ticketing to get the Jira issue/request tight to the Episode and displayed under impact. I did not attach the whole python script yet not sure where to send it. ... View more

Hi @guilmxm  Just let me know on how I can support you. I can apply changes from our git repo to get it deployed, in case you want me to test. //Peter ... View more

By using the jirarest command we are able to create service requests in Jira. Not nice but it works. In the end we would love seeing this working with Splunk ITSI alert action. For now it will end up in a correlation search. According to the documentation the map command is not supported after an appendpipe but again it works. |makeresults |eval description="This is the issues description set by the itsi description field" |eval summary="[TEST]This is the issues summary" |eval request_type="Request" |eval servicedesk_id="123" |eval target="/rest/servicedeskapi/servicedesk/".servicedesk_id."/requesttype" |appendpipe[ |map search=" | jirarest account="JiraTEST" target="$target$" | spath output=id path=values{}.id | spath output=name path=values{}.name | eval _time=now() | table id name " ] |stats list(id) as id list(name) as name first(request_type) as request_type first(servicedesk_id) as servicedesk_id first(description) as description first(summary) as summary |eval pos=mvfind(name,request_type) |where NOT isnull(pos) |eval type=mvindex(id,pos) |eval payload="{\"serviceDeskId\": \"".servicedesk_id."\",\"requestTypeId\": \"".type."\",\"requestFieldValues\": {\"summary\": \"".summary."\",\"description\": \"".description."\"}}" |map search="jirarest account="JiraTEST" target="/rest/servicedeskapi/request" method="POST" json_request="$payload$"" ... View more

This is a curl request which does work for the mentioned URL: curl --request POST 'https://a.b.c.com/rest/servicedeskapi/request' \ --header 'Authorization: Basic xXxXxXxXXXXXxxxxXXXxxxxxxxXXXXXXXXXxxxxxxxxxxxxx' \ --header 'Content-Type: application/json' \ --data-raw '{ "serviceDeskId": "279", "requestTypeId": "3504", "requestFieldValues": { "summary": "TestRequest JSD help via REST", "description": "This is a test request" } }' ... View more