The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"id": "uD31xU0VYjogxWoY",
"name": "Create_Unique_Jira_tickets_from_Splunk_alerts",
"tags": [
{
"id": "GCHVocImoXoEVnzP",
"name": "\ud83d\udee0\ufe0f In progress",
"createdAt": "2023-10-31T02:17:21.618Z",
"updatedAt": "2023-10-31T02:17:21.618Z"
},
{
"id": "QPJKatvLSxxtrE8U",
"name": "Secops",
"createdAt": "2023-10-31T02:15:11.396Z",
"updatedAt": "2023-10-31T02:15:11.396Z"
}
],
"nodes": [
{
"id": "3f9fa220-1966-4478-b7db-c39056564c9d",
"name": "Webhook",
"type": "n8n-nodes-base.webhook",
"position": [
-640,
320
],
"parameters": {
"path": "f2a52578-2fef-40a6-a7ff-e03f6b751a02",
"options": {},
"httpMethod": "POST"
},
"typeVersion": 1
},
{
"id": "375ac47e-7975-45cb-b7c1-cef1c7fca701",
"name": "Add Ticket Comment",
"type": "n8n-nodes-base.jira",
"position": [
240,
520
],
"parameters": {
"comment": "=Timestamp: {{ $('Set Host Name').item.json.body.timestamp }}\nDescription: {{ $('Set Host Name').item.json.body.description }}",
"options": {},
"issueKey": "={{ $json.key }}",
"resource": "issueComment"
},
"credentials": {
"jiraSoftwareCloudApi": {
"name": "<your credential>"
}
},
"typeVersion": 1
},
{
"id": "a5dea875-6adf-4d18-aeb9-5fe31a0ebfae",
"name": "Search Ticket",
"type": "n8n-nodes-base.jira",
"position": [
-200,
320
],
"parameters": {
"options": {
"jql": "=splunkhostname ~ \"{{ $json['splunk-host-name'] }}\" "
},
"operation": "getAll"
},
"credentials": {
"jiraSoftwareCloudApi": {
"name": "<your credential>"
}
},
"typeVersion": 1,
"alwaysOutputData": true
},
{
"id": "3dac410e-1e37-463d-9aba-bc6abf3889f7",
"name": "Set Host Name",
"type": "n8n-nodes-base.set",
"position": [
-420,
320
],
"parameters": {
"values": {
"string": [
{
"name": "splunk-host-name",
"value": "={{ $json.body.inputs.A.key['host.name'].replace(/[^a-zA-Z0-9 ]/g, '') }}"
}
]
},
"options": {}
},
"typeVersion": 2
},
{
"id": "465ec3b0-dd16-482e-b4b6-f8ed91fbb11b",
"name": "IF Ticket Not Exists",
"type": "n8n-nodes-base.if",
"position": [
20,
320
],
"parameters": {
"conditions": {
"string": [
{
"value1": "={{ $json.key }}",
"operation": "isEmpty"
}
]
}
},
"typeVersion": 1
},
{
"id": "1315b76b-39fc-4fd3-9a45-a91e5e873874",
"name": "Sticky Note",
"type": "n8n-nodes-base.stickyNote",
"position": [
-1120,
-26.960531840248223
],
"parameters": {
"width": 643.8620281403546,
"height": 537.944771288002,
"content": "\n## Webhook Node \nTo setup your webhook integration for Splunk, first ensure that splunk is setup to send alerts to a webhook by visiting the [Setup Guide here](https://docs.splunk.com/observability/en/admin/notif-services/webhook.html). You will copy the n8n webhook url opening the webhook node below. \n- **Form Access URLs**:\n - **Execute Mode**: `https://n8n.domain.com/webhook/test/webhookpath` - Use this to execute the workflow interactively within the n8n canvas. Hit the 'Execute Workflow' button to see real-time execution results. We have pinned data in the webhook node to make testing easier. \n - **Silent Mode**: `https://n8n.domain.com/webhook/webhookpath` - Use this for background execution without canvas updates. Results will be logged silently and can be reviewed in the 'Executions' tab."
},
"typeVersion": 1
},
{
"id": "636425b9-a11f-4891-aa00-2f3c42956c01",
"name": "Create Ticket",
"type": "n8n-nodes-base.jira",
"position": [
240,
160
],
"parameters": {
"project": {
"__rl": true,
"mode": "list",
"value": "10001",
"cachedResultName": "Service Desk"
},
"summary": "=Splunk Alert for host {{ $('Set Host Name').item.json.body.inputs.A.key[\"host.name\"] }}: {{ $('Set Host Name').item.json.body.description }}",
"issueType": {
"__rl": true,
"mode": "list",
"value": "10004",
"cachedResultName": "[System] Incident"
},
"additionalFields": {
"description": "={{ $('Set Host Name').item.json.body.description }}\n\n{{ $('Set Host Name').item.json.body.messageBody }}",
"customFieldsUi": {
"customFieldsValues": [
{
"fieldId": {
"__rl": true,
"mode": "id",
"value": "customfield_10063"
},
"fieldValue": "={{ $('Webhook').item.json[\"body\"][\"inputs\"][\"A\"][\"key\"][\"host.name\"].replace(/[^a-zA-Z0-9 ]/g, '') }}"
}
]
}
}
},
"credentials": {
"jiraSoftwareCloudApi": {
"name": "<your credential>"
}
},
"typeVersion": 1
},
{
"id": "47af8bdb-e0da-4923-8f0a-05deb86ac1b3",
"name": "Sticky Note1",
"type": "n8n-nodes-base.stickyNote",
"position": [
-460,
98.72468966845895
],
"parameters": {
"width": 401.99970102055784,
"height": 413.43480804607805,
"content": "\n## Normalize Hostname \nTo ensure no special characters are passed into jira and create issues, this set node removes special characters from the `splunk-host-name` and uses that to search and create tickets. This host name is saved as a custom field. "
},
"typeVersion": 1
},
{
"id": "c0bf09e6-ca08-4db6-aff0-a6528a8fb03b",
"name": "Sticky Note2",
"type": "n8n-nodes-base.stickyNote",
"position": [
180,
-21.934709587377256
],
"parameters": {
"width": 401.99970102055784,
"height": 348.38243930996134,
"content": "\n## Create a new ticket\nThis creates a new ticket in your Prjoect and issue type. Ensure to update these values to ensure it works correctly. "
},
"typeVersion": 1
},
{
"id": "a175e343-83ed-4442-94df-7e7027b8c687",
"name": "Sticky Note3",
"type": "n8n-nodes-base.stickyNote",
"position": [
180,
340
],
"parameters": {
"width": 401.99970102055784,
"height": 341.08777742613927,
"content": "\n## Add Ticket Comment\nThis adds the alert as a comment in the existing ticket, to ensure the data is not duplicated. "
},
"typeVersion": 1
},
{
"id": "09143b8c-a4ce-4791-8937-3333d24b6e01",
"name": "Sticky Note4",
"type": "n8n-nodes-base.stickyNote",
"position": [
-40,
100.50445897107033
],
"parameters": {
"width": 193.6032856277124,
"height": 415.27445353029793,
"content": "## Check if ticket found\nThis checks `$json.key` to see if the value was found, and route accordingly."
},
"typeVersion": 1
}
],
"active": false,
"settings": {
"executionOrder": "v1"
},
"versionId": "3985cac2-7f23-4d27-b826-0edfb0544b58",
"connections": {
"Webhook": {
"main": [
[
{
"node": "Set Host Name",
"type": "main",
"index": 0
}
]
]
},
"Search Ticket": {
"main": [
[
{
"node": "IF Ticket Not Exists",
"type": "main",
"index": 0
}
]
]
},
"Set Host Name": {
"main": [
[
{
"node": "Search Ticket",
"type": "main",
"index": 0
}
]
]
},
"IF Ticket Not Exists": {
"main": [
[
{
"node": "Create Ticket",
"type": "main",
"index": 0
}
],
[
{
"node": "Add Ticket Comment",
"type": "main",
"index": 0
}
]
]
}
}
}
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
jiraSoftwareCloudApi
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
How this works
This workflow transforms Splunk security alerts into unique Jira tickets, ensuring critical incidents are tracked without duplicates and enabling swift team responses to potential threats. It suits security operations centres or IT teams managing high-volume alerts from monitoring tools like Splunk, automating the triage process to focus human effort on resolution rather than manual entry. The key step involves searching for existing Jira tickets based on alert details before creating a new one, integrating seamlessly with Jira to maintain a clean issue log.
Use this workflow when handling repetitive Splunk alerts that require documented follow-up in Jira, such as network intrusions or system failures, to streamline incident management. Avoid it for low-priority notifications or environments without Jira integration, as it relies on webhook triggers for real-time processing. Common variations include adding Slack notifications for immediate alerts or custom fields in Jira tickets to capture specific Splunk metrics like host names.
About this workflow
Create_Unique_Jira_tickets_from_Splunk_alerts. Uses jira, stickyNote. Webhook trigger; 11 nodes.
Source: https://github.com/Zie619/n8n-workflows — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
A clean, extensible REST-style API routing template for n8n webhooks with up to 3 path levels. Serves API routes via Webhooks with path variables Normalizes incoming requests into "global" REQUEST and
PUQ Docker NextCloud deploy. Uses respondToWebhook, stickyNote, httpRequest, ssh. Webhook trigger; 44 nodes.
puq-docker-immich-deploy. Uses respondToWebhook, ssh, stickyNote. Webhook trigger; 35 nodes.
Analyze_email_headers_for_IPs_and_spoofing__3. Uses stickyNote, respondToWebhook, itemLists, httpRequest. Webhook trigger; 35 nodes.