I am configuring the Jira Issue Input Add-on to ingest enterprise security incidents into Splunk using a JQL query. The JQL returns the correct Jira issues, but I need to confirm how the add-on determines which issue fields are returned and indexed in Splunk. The dashboard requires fields such as: Jira issue key Project Issue type Summary Description Created Updated Status Resolution Priority or severity Assignee Reporter Labels Components Hostname or device information Customer Request Type org dept information Other Jira custom fields Questions: Does the add-on ingest all fields returned by the Jira REST API, including custom fields? Is there a configuration where specific Jira fields must be listed? Does the JQL only control which issues are returned, or does it also control the fields returned? How are Jira custom fields represented in Splunk, for example customfield_12345? Is there a recommended way to map Jira custom field IDs to readable Splunk field names? Does the add-on support historical backfill using the same JQL query? Is there a sample event or field extraction example showing the expected JSON structure? The JQL is similar to: ( ( project = "ORG IT Support" AND "Customer Request Type" = "Security Alert (ORGIT)" ) OR project = "Security Operations Center" ) AND ( description ~ "ORG" OR summary ~ "\"Manhattan Dept \"" OR summary ~ "\"Hackensack Dept\"" ) ORDER BY created DESC The goal is to replace a static CSV lookup with Jira data retrieved through the REST API and use the indexed issues for incident totals, monthly trends, City & Dept counts, device mapping, and detailed incident reporting. Environment: Splunk Enterprise Distributed deployment Jira collection expected to run from a Heavy Forwarder Jira Issue Input Add-on Jira REST API Dashboard Studio Any configuration examples for the modular input, source, sourcetype, JSON field extraction, and custom-field handling would be helpful. Suggested tags: jira jira-add-on modular-input rest-api jql heavy-forwarder field-extraction dashboard-studio
... View more
