icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Add-on for JIRA
SHA256 checksum (add-on-for-jira_222.tgz) 099949ce02857b9eca005eda3b114a4a11abc53037c2a250a5eef843bc387b3b SHA256 checksum (add-on-for-jira_221.tgz) 1b3a8be3918068e7a35aa238845eba73552deb8b5178955d9776e073afa0968b SHA256 checksum (add-on-for-jira_220.tgz) 365b7968246fe28cfaff511d8b31cdc7b3ca37eb3f55166df607c164634c0e92 SHA256 checksum (add-on-for-jira_21.zip) c338261d4363361479ffa732c2f309b475782d34006f4cb23450c2ec2754c1f6 SHA256 checksum (add-on-for-jira_201.tgz) 675e6e4fab2fd42e0ff394228527bf9f4195bbe992d9b7831d3ca2f795da1781 SHA256 checksum (add-on-for-jira_20.tgz) 5ff0a8d165e16989559bd737d813334c5d63f9f50e936a3b4a4faedd632508c2
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Add-on for JIRA

Splunk Labs
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
The Add-on for JIRA provides custom command that query JIRA REST API and Modular Input to index JIRA data.

Add-on for JIRA






  • List favorite filters of the configured user

| jira filters

  • Run a specific filter and return Issues

| jira issues FILTER_ID

  • Run a JQL search and return Issues. The JQL query should be encapsulated by double quotes with criteria encapsulated by single quotes. For example |jira jqlsearch "key='1234' and reporter='Fred de Boer'"

| jira jqlsearch "JQL_QUERY"

  • Run a JQL search and return the all Changes for all matching Issues.

| jira changelog "JQL_QUERY"

  • List rapidboards or sprints (Greenhopper REST API)

| jira rapidboards list|all|(RAPIDBOARD_ID [detail sprints|issues])

  • list will list all scrum boards. This is the default behavior.
  • all will list all sprints in all scrum boards.
  • RAPIDBOARD_ID will list all sprints in one specific scrum board.

    • "detail sprints" gives details on the active sprints in the rapidboard.
    • "detail issues" gives details on the active issues in the board including swimlanes and groupings.
    • Hint: to get issues in a sprint use jqlquery "sprint=sprint_id" after you have found the desired sprint id here with rapidboards.
  • Pipe search results into a jqlsearch

| search ... | eval foo="WTF-1,WTF-2,WTF-3" | makemv delim=, foo | map search="|jira batch JQL_QUERY $foo$"

  • The JQL_QUERY in the batch command is a partial query that ends with the IN keyword, e.g. "key in"
  • Results piped in from the preceding search will populate the IN clause.
  • Results piped in can be comma- or space- separated
  • This is a little ungainly, but quite powerful if you want to pull a list of JIRA keys from an external source and then get all the Issues from JIRA


  • comments
  • Shows comments for all Issues returned by main option.
  • Compatible with issues, jqlquery, and batch commands.

  • changefield

  • By default, pretty names for fields are show. Changefield outputs internal field names instead.
  • Compatible with issues, jqlquery and batch commands.

  • changetime TIME_FIELD

  • Sets _time to the chosen field. If field does not contain a valid, returns 0 Epoch time
  • _time defaults to created if changetime is not set
  • Compatible with issues, jqlquery, and batch commands.

  • fields "[INTERNAL_FIELD_NAME,...]"

  • Limits the set of fields returned
  • Takes a comma-separated list of internal field names. No extra spaces, we're too lazy to trim
  • If you want multiple fields, please enclose the field list in double-quotes
  • key and created are always returned

jirarest (REST API - deprecated)

Using Modular Input

From version 2.2.0, you can index JIRA ticket with jira modular input.
Once the modular input is enabled, it will start sync process which based on jql query to fetches tickets from JIRA server. After sync process finishes, the modular input will get updated tickets every "interval" seconds.
This is one example of inputs.conf, for using it, configure your server and credential then copy to local/inputs.conf.

sourcetype = jira
interval = 60
server = jira.buttercup.com
protocol = https
port = 443
jql = issueType in (epic, story)
username = username
password = password
disabled = 1


  1. Place the app into $SPLUNK_HOME/etc/apps/jira
  2. Create a folder named local, copy default/jira.conf into local, and update with configuration specific to your instance.
  3. Copy $SPLUNK_HOME/etc/apps/jira/bin/config.ini.sample to $SPLUNK_HOME/etc/apps/jira/bin/config.ini and update with your authentication credentials

Configure which keys to display in the table with the keys, time_keys, and custom_keys fields.


  • jirarest command written by Fred de Boer
  • jirasoap command written by Fred de Boer
  • jiraxml command written by Stephen Sorkin and Jeffrey Isenberg
  • ModInput written by Vu Pham
  • The Splunk MySQL app was used as a model, and lots of snippets here were stolen from its commands
  • To support the jirasoap command, this App redistributes suds 4.0 https://fedorahosted.org/suds/

Release Notes

Version 2.2.2
Feb. 15, 2017
Version 2.2.1
Jan. 14, 2017
  • Provided only jira command to live query JIRA REST API. Deprecated jirarest commands. Removed jirasoap, jiraxml commands.
  • Added ability to index data from JIRA REST API. Please see README/inputs.conf.spec for detail.
  • Added necessary extraction for Splunk ITSI Module for Continuous Delivery
Version 2.2.0
Jan. 11, 2017
  • Provided only jira command to live query JIRA REST API. Deprecated jirarest, jirasoap, jiraxml commands are removed.
  • Added ability to index data from JIRA REST API. Please see README/inputs.conf.spec for detail.
  • Added necessary extraction for Splunk ITSI Module for Continuous Delivery
Version 2.1
Nov. 21, 2014

Added a new "detail" option to the rapidboards mode that gives extra information about sprints or issues on the board.
Fixed a bug when a Label has the value "Label".

Version 2.0.1
June 3, 2014

Fix an urlencoding bug in the JIRA REST command that broke search strings which contained special characters.

Version 2.0
June 2, 2014

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.