Duplicate Issue - Same MD5

jmbecker commented 3 years ago

Hello,

First - let me thank you for this addon. We're currently using it to create tickets and it has definitely streamlined our processes and given us some great functionality. Thank you for that.

We're currently trying to figure out why we're getting a duplicated ticket created, even though we've got dedup enabled, with JIRA dedup excluded status categories and JIRA dedup content filled-in. The interesting part is that the second ticket created receives comment updates without issue as subsequent alerts are triggered. We're wondering if we've found a bug or if we messed something up along the way.

An example of the process:

Alert fires for the first time during the day. Internal logs show that a ticket with the same MD5 hash was found, but it was closed, so it creates a new ticket.
Alert fires a second time. A SECOND ticket gets created. The MD5 hash of the second ticket is the same as the MD5 hash of the first. Internal logs state that the calculated md5 hash for this issue creation request was NOT found in the backlog collection.
Subsequent alerts update the SECOND ticket with the jira_update_comment that we have defined in the alert's search without issue.

Supporting info:

We're currently running version 1.0.28 of the addon. I realize that's a few versions behind, but I looked through release notes and didn't see anything that matched up with what we're seeing, unless I'm missing it. Getting updates can be a bit difficult so I wanted to check to see if there was an easier fix before going that route.
Splunk Enterprise on-prem, 8.1.4.
The key in the issues backlog collection matches the jira_md5 only for the SECOND ticket created.

This got a bit longer than I wanted, but hopefully that gives you sufficient information. Let me know if I'm missing any information or if I can help in any other way. Thanks again for the addon, it's been great!

guilhemmarchand commented 3 years ago

Hi @jmbecker !

I am glad the Add-on is useful to you, and very happy you use all the powerful features ;-)

So, actually I do believe this is was indeed especially fixed in the release 2.0.0:

Fix - Issue #102 - Issue in dedup behaviour when dedup is enabled but the issue was resolved, closed or cancelled

Link to the issue: https://github.com/guilhemmarchand/TA-jira-service-desk-simple-addon/issues/102

This all looks like the conditions you've met. I would recommend you to upgrade to the latest release in Splunk Base, and verify, this should have fixed this issue effectively!

Let me know

Guilhem

jmbecker commented 3 years ago

Oops, I must have missed that in the release notes. Sorry about that! I'll reach out to our Splunk admins and get it updated to the newest version. I can come back and update once they've deployed the newest version. Thanks!

guilhemmarchand commented 3 years ago

@jmbecker

I am assuming this answered to the queston, feel free to re-open this issue if necessary.

guilhemmarchand / TA-jira-service-desk-simple-addon

Duplicate Issue - Same MD5 #115