firebus / splunk-jira Goto Github PK
View Code? Open in Web Editor NEWA Splunk Add-on for JIRA
Home Page: http://apps.splunk.com/app/1438/
License: Other
A Splunk Add-on for JIRA
Home Page: http://apps.splunk.com/app/1438/
License: Other
This was due to erroneous evaluation of list type where an implicit "If" statement caused the ignoring of other label fields than "Labels". Corrected in new Rest Version.
Currently _time is set to now() when events/results are created. Some folks might want _time set to the updated or created fields. Let's add an option to the command to support setting _time to some other time field in the Issue
Are these typos intentional?
This is a JIRA Add-on for Splunk.
Download from http://www.gitub.com/firebus/splunk-jira (gitub)
Upgoat at http://splunkbase.splunk.com/apps/JIRA (Upgoat)
(I got a good crack out of upgoat :-). That should be a verb if it isn't already.)
This may allow us to inject events into an existing stream of events.
So that we don't have to wait forever to start seeing results when there are >1000 Issues returned
I checked jira.py and jira_soap.py, and found jura_soap.py didn't get key set and customFields from jira.conf as jira.py
As a result, only those hardcoded fields will be put in table.
I saw a TODO comment in jira_soap.py.
Could you please enhance that part? The JIRA system I use have many customized fields, and only can be called via SOAP API.
If you don't have leisure time to fix this, then I have to fork this and change jira_soap.py from time to time. That'll be a quick and dirty solution.
Thank you in advanced.
Fields like links, subtasks, etc. have a nested representation in SearchXML's response format. In order to target them, we need to add an xpath to the configuration. e.g.
keys = labels/label, subtasks/subtask
Let's find a way to abbreviate these fields in the output, or to alias xpaths to field names in some general way
Reported originally in #13, spinning off a separate Issue/Bug for this.
Using the changelog command on a Jira issue which contains one or more changelog entries without an author will cause the changelog command to return 0 results:
| jira changelog key=SPL-128702
The above-mentioned Jira issue contains multiple entries in the changelog which show up in Jira as: Anonymous made changes
...
When running the above command, these errors were observed in search.log:
03-22-2017 16:39:36.659 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/jira/bin/jira_rest.py changelog key=SPL-128702': Traceback (most recent call last):
03-22-2017 16:39:36.659 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/jira/bin/jira_rest.py changelog key=SPL-128702': File "/opt/splunk/etc/apps/jira/bin/jira_rest.py", line 440, in <module>
03-22-2017 16:39:36.659 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/jira/bin/jira_rest.py changelog key=SPL-128702': row['user'] = field['author']['name']
03-22-2017 16:39:36.659 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/jira/bin/jira_rest.py changelog key=SPL-128702': KeyError: 'author'
03-22-2017 16:39:36.669 WARN ScriptRunner - Killing script, probably timed out, grace=0sec, script="/opt/splunk/bin/python /opt/splunk/etc/apps/jira/bin/jira_rest.py changelog key=SPL-128702"
The _raw field needs to be parseable - which includes line returns between values of a multi-value fields. In essence, we'll have to duplicate the formatting of intersplunk.outputResults.
I'm trying to set this up and I keep getting command="jirasoap", <urlopen error [Errno 111] Connection refused>
. I can log in using curl from that Splunk machine, so the only thing I can think of is that this app is not compatible with Jira 6.0.
When passing queries that contain characters that should be encoded (#,$,%) the queries will fail due to improper handling.
Create a new JIRA Issue from a Splunk search.
In the SearchXML response, there are separate sets of inbound and outbound links. There are also different kinds of links. We should merge links into a single multi-value field, and find a way to represent the type, direction, and target.
I'm not being deliberately obtuse :), but I am not getting any data from the search job. I've installed the app on my search head, opened my FW to the Jira server from my search head, but I don't see any data coming into the search. Where do I need to install this app?
Thanks
Suppose I should elaborate:
on my search head I've got $SPLUNK_HOME/etc/apps/jira/local/jira.conf & $SPLUNK_HOME/etc/apps/jira/bin/config.ini, w/ my local Jira config (host, username, port, so on).
I can telnet lira.domain.com 80 from the search head where I've installed the app. However, I'm getting Connection failed under status monitoring for the Jira server.
I checked the script and found the url being formed is
https://jira.lufthansa.com/rest/api/2/search?jql=comment%20~%20%22Nimish%20Kumar%22%20AND%20resolved%20%3E%3D%20-12w
which is working fine but the jqlquey search in splunk is not working.
Could you please tell why the search from splunk is not giving ny result
Done in new Rest Command.
In environments where performance is a concern the maximum number of results is far less than 1000. In environments performance cap may be set to 100 results.
If would be on line 253 or similar where reading the response header would be require.
Previous version would return a Reporter name, Status name etc., overhaul of jira_rest.py now returns what seems an exhaustive set of properties for each field ( the reporter's id, path for icon, icon size etc).
While these things might be useful in some cases (hard to imagine where the icon size would be relevant, but who knows), the real issue is that the resulting row passed to the search results is a combination of correctly structured json with incorrectly structured json, at least to the extent that splunk can't parse it. We get the Reporter field being what looks like a json object, but are unable to directly access the sub-objects. I.E., Reporter.displayName.
Also, list objects, like the labels field, should be MV fields in the result event.
jira and jirasoap both the the _raw field in their result rows, so that if you run the 'events' version of the command, you have something to look at in the events
however, when _raw is set and you collect results in a summary index, the summary index ignores the existing fields, and re-parses _raw instead.
if we want to set _raw, we need to make is parseable - which is actually a little annoying for things like multivalue fields. it would be nice if intersplunk.outputResults would return directly instead of writing to file. maybe there's some way to make python do this that i'm missing.
in an case, this bug is to remove the _raw field entirely, and we'll open a separate issue to add a working _raw field.
It should be possible to pipe search results into a comment on an existing JIRA Issue
And then deprecate the SOAP and SearchXML interfaces.
the functionality in jira.py doesn't seem to work. I get a correct number of results but no fields.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.