Problem parsing Jira Webhook in Splunk

[Tom Brown]

Hi Community,

Does anyone have any insights to the following problem I am having trying to fire a Webhook into Splunk.

Splunk is receiving the Webhook but gives the following error:

Failed processing http input, token name=Jira test - v2, channel=n/a, source_IP=XX.XX.XX.XX, reply=16, events_processed=0, http_input_body_size=5711, parsing_err=""

[Andy Rusnak · Accepted solution]

Hi Thomas, 

Thanks for leveraging the Atlassian Community!  I understand that you are trying to fire a Jira webhook sending to a Splunk endpoint and Splunk is failing to process the request.  

In this case, if the webhook is firing, we would likely need to troubleshoot from the Splunk endpoint side to see what is causing it not to be able to process the request.  You can validate the webhook body that Jira is sending by using something like requestbin.com and pointing your Jira webhook to a requestbin endpoint. That would allow you the ability to see the body of the webhook that Jira is sending.  Additional information can be found within How to collect data to troubleshoot webhook failure in Jira.  This article outlines how you can look at what the Jira webhook component is doing.  

But if the event is making it to Splunk, then the Jira webhook event is no longer involved.  

Best,

Andy

[Tom Brown]

Thanks @Andy Rusnak we already tested as you have advised and agree that the problem is at the Splunk end.