{
  "id": "uD31xU0VYjogxWoY",
  "meta": {
    "instanceId": "workflow-2d08723c",
    "versionId": "1.0.0",
    "createdAt": "2025-09-29T07:07:55.168604",
    "updatedAt": "2025-09-29T07:07:55.168630",
    "owner": "n8n-user",
    "license": "MIT",
    "category": "automation",
    "status": "active",
    "priority": "high",
    "environment": "production"
  },
  "name": "Create_Unique_Jira_tickets_from_Splunk_alerts",
  "tags": [
    "automation",
    "n8n",
    "production-ready",
    "excellent",
    "optimized"
  ],
  "nodes": [
    {
      "id": "3f9fa220-1966-4478-b7db-c39056564c9d",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -640,
        320
      ],
      "webhookId": "f2a52578-2fef-40a6-a7ff-e03f6b751a02",
      "parameters": {
        "path": "f2a52578-2fef-40a6-a7ff-e03f6b751a02",
        "options": {},
        "httpMethod": "POST"
      },
      "typeVersion": 1,
      "notes": "This webhook node performs automated tasks as part of the workflow."
    },
    {
      "id": "375ac47e-7975-45cb-b7c1-cef1c7fca701",
      "name": "Add Ticket Comment",
      "type": "n8n-nodes-base.jira",
      "position": [
        240,
        520
      ],
      "parameters": {
        "comment": "=Timestamp: {{ $('Set Host Name').item.json.body.timestamp }}\nDescription: {{ $('Set Host Name').item.json.body.description }}",
        "options": {},
        "issueKey": "YOUR_CREDENTIAL_HERE",
        "resource": "issueComment"
      },
      "credentials": {
        "jiraSoftwareCloudApi": {
          "id": "OYvpDV2Q42eY6iyA",
          "name": "Alex Jira Cloud"
        }
      },
      "typeVersion": 1,
      "notes": "This jira node performs automated tasks as part of the workflow."
    },
    {
      "id": "a5dea875-6adf-4d18-aeb9-5fe31a0ebfae",
      "name": "Search Ticket",
      "type": "n8n-nodes-base.jira",
      "position": [
        -200,
        320
      ],
      "parameters": {
        "options": {
          "jql": "=splunkhostname ~ \"{{ $json['splunk-host-name'] }}\" "
        },
        "operation": "getAll"
      },
      "credentials": {
        "jiraSoftwareCloudApi": {
          "id": "OYvpDV2Q42eY6iyA",
          "name": "Alex Jira Cloud"
        }
      },
      "typeVersion": 1,
      "alwaysOutputData": true,
      "notes": "This jira node performs automated tasks as part of the workflow."
    },
    {
      "id": "3dac410e-1e37-463d-9aba-bc6abf3889f7",
      "name": "Set Host Name",
      "type": "n8n-nodes-base.set",
      "position": [
        -420,
        320
      ],
      "parameters": {
        "values": {
          "string": [
            {
              "name": "splunk-host-name",
              "value": "={{ $json.body.inputs.A.key['host.name'].replace(/[^a-zA-Z0-9 ]/g, '') }}"
            }
          ]
        },
        "options": {}
      },
      "typeVersion": 2,
      "notes": "This set node performs automated tasks as part of the workflow."
    },
    {
      "id": "465ec3b0-dd16-482e-b4b6-f8ed91fbb11b",
      "name": "IF Ticket Not Exists",
      "type": "n8n-nodes-base.if",
      "position": [
        20,
        320
      ],
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{ $json.key }}",
              "operation": "isEmpty"
            }
          ]
        }
      },
      "typeVersion": 1,
      "notes": "This if node performs automated tasks as part of the workflow."
    },
    {
      "id": "1315b76b-39fc-4fd3-9a45-a91e5e873874",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -1120,
        -26.960531840248223
      ],
      "parameters": {
        "width": 643.8620281403546,
        "height": 537.944771288002,
        "content": "![VirusTotal]({{ $env.WEBHOOK_URL }}\n## Webhook Node \nTo setup your webhook integration for Splunk, first ensure that splunk is setup to send alerts to a webhook by visiting the [Setup Guide here]({{ $env.WEBHOOK_URL }} You will copy the n8n webhook url opening the webhook node below. \n- **Form Access URLs**:\n  - **Execute Mode**: `{{ $env.WEBHOOK_URL }}` - Use this to execute the workflow interactively within the n8n canvas. Hit the 'Execute Workflow' button to see real-time execution results. We have pinned data in the webhook node to make testing easier. \n  - **Silent Mode**: `{{ $env.WEBHOOK_URL }}` - Use this for background execution without canvas updates. Results will be logged silently and can be reviewed in the 'Executions' tab."
      },
      "typeVersion": 1,
      "notes": "This stickyNote node performs automated tasks as part of the workflow."
    },
    {
      "id": "636425b9-a11f-4891-aa00-2f3c42956c01",
      "name": "Create Ticket",
      "type": "n8n-nodes-base.jira",
      "position": [
        240,
        160
      ],
      "parameters": {
        "project": {
          "__rl": true,
          "mode": "list",
          "value": "10001",
          "cachedResultName": "Service Desk"
        },
        "summary": "=Splunk Alert for host {{ $('Set Host Name').item.json.body.inputs.A.key[\"host.name\"] }}:  {{ $('Set Host Name').item.json.body.description }}",
        "issueType": {
          "__rl": true,
          "mode": "list",
          "value": "10004",
          "cachedResultName": "[System] Incident"
        },
        "additionalFields": {
          "description": "={{ $('Set Host Name').item.json.body.description }}\n\n{{ $('Set Host Name').item.json.body.messageBody }}",
          "customFieldsUi": {
            "customFieldsValues": [
              {
                "fieldId": {
                  "__rl": true,
                  "mode": "id",
                  "value": "customfield_10063"
                },
                "fieldValue": "={{ $('Webhook').item.json[\"body\"][\"inputs\"][\"A\"][\"key\"][\"host.name\"].replace(/[^a-zA-Z0-9 ]/g, '') }}"
              }
            ]
          }
        }
      },
      "credentials": {
        "jiraSoftwareCloudApi": {
          "id": "OYvpDV2Q42eY6iyA",
          "name": "Alex Jira Cloud"
        }
      },
      "typeVersion": 1,
      "notes": "This jira node performs automated tasks as part of the workflow."
    },
    {
      "id": "47af8bdb-e0da-4923-8f0a-05deb86ac1b3",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -460,
        98.72468966845895
      ],
      "parameters": {
        "width": 401.99970102055784,
        "height": 413.43480804607805,
        "content": "![VirusTotal]({{ $env.WEBHOOK_URL }}\n## Normalize Hostname \nTo ensure no special characters are passed into jira and create issues, this set node removes special characters from the `splunk-host-name` and uses that to search and create tickets. This host name is saved as a custom field. "
      },
      "typeVersion": 1,
      "notes": "This stickyNote node performs automated tasks as part of the workflow."
    },
    {
      "id": "c0bf09e6-ca08-4db6-aff0-a6528a8fb03b",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        180,
        -21.934709587377256
      ],
      "parameters": {
        "width": 401.99970102055784,
        "height": 348.38243930996134,
        "content": "![VirusTotal]({{ $env.WEBHOOK_URL }}\n## Create a new ticket\nThis creates a new ticket in your Prjoect and issue type. Ensure to update these values to ensure it works correctly. "
      },
      "typeVersion": 1,
      "notes": "This stickyNote node performs automated tasks as part of the workflow."
    },
    {
      "id": "a175e343-83ed-4442-94df-7e7027b8c687",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        180,
        340
      ],
      "parameters": {
        "width": 401.99970102055784,
        "height": 341.08777742613927,
        "content": "![VirusTotal]({{ $env.WEBHOOK_URL }}\n## Add Ticket Comment\nThis adds the alert as a comment in the existing ticket, to ensure the data is not duplicated. "
      },
      "typeVersion": 1,
      "notes": "This stickyNote node performs automated tasks as part of the workflow."
    },
    {
      "id": "09143b8c-a4ce-4791-8937-3333d24b6e01",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -40,
        100.50445897107033
      ],
      "parameters": {
        "width": 193.6032856277124,
        "height": 415.27445353029793,
        "content": "## Check if ticket found\nThis checks `$json.key` to see if the value was found, and route accordingly."
      },
      "typeVersion": 1,
      "notes": "This stickyNote node performs automated tasks as part of the workflow."
    }
  ],
  "active": false,
  "pinData": {
    "Webhook": [
      {
        "json": {
          "body": {
            "tip": null,
            "rule": "n8n-test",
            "inputs": {
              "A": {
                "key": {
                  "os.type": "linux",
                  "host.name": "n8n-enterprise-demo",
                  "sf_metric": "cpu.utilization"
                },
                "value": "0.1670342357065173",
                "fragment": "data('cpu.utilization').publish(label='A')"
              },
              "_S2": {
                "value": "0.2",
                "fragment": "threshold(0.2)"
              }
            },
            "status": "ok",
            "detector": "n8n-test",
            "imageUrl": "{{ $env.WEBHOOK_URL }}",
            "severity": "Critical",
            "eventType": "F5Vx1EuAAKc__F5V-TcTAEJ8__n8n-test",
            "sf_schema": 2,
            "timestamp": "2023-09-06T14:17:00Z",
            "detectorId": "F5V-TcTAEJ8",
            "incidentId": "F5VAq10AEAA",
            "runbookUrl": null,
            "description": "The value of cpu.utilization is above 0.2.",
            "detectorUrl": "{{ $env.WEBHOOK_URL }}",
            "messageBody": "Rule \"n8n-test\" in detector \"n8n-test\" cleared at Wed, 6 Sep 2023 14:17:00 GMT.\n\nCurrent signal value for n8n.test: 0.1670342357065173\n\nSignal details:\n{sf_metric=cpu.utilization, host.name=n8n-enterprise-demo, os.type=linux}",
            "messageTitle": "Back to normal: n8n-test (n8n-test)",
            "statusExtended": "ok",
            "detectOnCondition": "when(A > threshold(0.2))",
            "originatingMetric": "cpu.utilization",
            "triggeredWhileMuted": false
          },
          "query": {},
          "params": {},
          "headers": {
            "host": "internal.users.n8n.cloud",
            "x-real-ip": "10.255.0.2",
            "user-agent": "Apache-HttpClient/4.5.14 (Java/1.8.0_372)",
            "content-type": "application/json; charset=utf-8",
            "content-length": "1366",
            "accept-encoding": "gzip,deflate",
            "x-forwarded-for": "10.255.0.2",
            "x-forwarded-host": "internal.users.n8n.cloud",
            "x-forwarded-port": "443",
            "x-forwarded-proto": "https",
            "x-forwarded-server": "e591fa1c2d01"
          }
        }
      }
    ]
  },
  "settings": {
    "executionOrder": "v1",
    "saveManualExecutions": true,
    "callerPolicy": "workflowsFromSameOwner",
    "errorWorkflow": null,
    "timezone": "UTC",
    "executionTimeout": 3600,
    "maxExecutions": 1000,
    "retryOnFail": true,
    "retryCount": 3,
    "retryDelay": 1000
  },
  "versionId": "3985cac2-7f23-4d27-b826-0edfb0544b58",
  "connections": {
    "3f9fa220-1966-4478-b7db-c39056564c9d": {
      "main": [
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d-530c968e",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d-c25d10a9",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d-5e0e07f2",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d-1e5b1f2e",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d-1951f8fd",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d-df367e69",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d-77130f8b",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "error-handler-3f9fa220-1966-4478-b7db-c39056564c9d-23e36319",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "description": "Automated workflow: Create_Unique_Jira_tickets_from_Splunk_alerts. This workflow integrates 6 different services: webhook, stickyNote, set, stopAndError, jira. It contains 13 nodes and follows best practices for error handling and security.",
  "notes": "Excellent quality workflow: Create_Unique_Jira_tickets_from_Splunk_alerts. This workflow has been optimized for production use with comprehensive error handling, security, and documentation."
}