All Apps and Add-ons

Add-on for Atlassian JIRA Service Desk alert action: Getting errors and components are required when alert is triggered in the logs.



We have an issue where when we set up the alert action we put all the required fields with the red *. We trigger the alert and in the logs, we see that it is requiring the content: components.

"fields": {
        "issuetype": {
            "name": "Task"
        "priority": {
            "name": "High"
        "summary": "Splunk Alert:  Alert", 
        "project": {
            "key": "id "
        "description": "The alert condition for ' Alert' was triggered."
}, **HTTP Error=400, content={"errorMessages":[],"errors":{"components":"Components is required."}}**"

In custom fields we put a component and we triggered the alert and we got a different error :

 \"content\": {\"component\": { \"name\": \"Incidents"} }

}" **action_name="jira_service_desk" search_name="CrowdStrike Detection Alert"  signature="Unexpected error: Expecting property name enclosed in double quotes: line 15 column 2 (char 257)."** 

Can you please Advise?


Labels (2)
0 Karma


Hi @amksa

Hum right, I will need to perform some verifications, can you confirm that the message:

HTTP Error=400, content={"errorMessages":[],"errors":{"components":"Components is required."}}

Is returned by JIRA ? This might indicate effectively a required field maybe for the tasks or in respect with your JIRA fields configuration.

The custom field section is meant to be used for proper custom fields only, this shouldn't apply for non custom fields.


0 Karma


So @amksa

I could re-reproduce this, by default the field "Components" is an optional field in JIRA, not required.

But certainly your JIRA admin has defined this field to be mandatory, which is why the creation is failing with the following message:

Components REQUIRED
[Autocomplete Renderer

}, HTTP Error=400, content={"errorMessages":[],"errors":{"components":"Components is required."}}"

I am checking if how this can be managed.


0 Karma



Please upgrade to the version 1.0.8 of the add-on, that was published on Splunk Base.

This version will allow you to define the Components field in the custom field section, without its section to be managed as characters to be protected. (the reason why it failed when you attempted to do so.)

Assuming your JIRA admins allowed the field to be defined in the screens, and you input values format accepted by your JIRA, this will fix your issue.

Let me know if any further issue.


0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...