topic Re: Has anyone gotten the Splunk Salesforce app to work? in All Apps and Add-ons

Has anyone gotten the Splunk Salesforce app to work?

mkirda1 — Mon, 31 Oct 2022 15:10:15 GMT

Worked extensively with Splunk support on this. They believe that the problem is that the app is either fundamentally incompatible with Splunk 9 or the latest Salesforce TA.

Ultimately splunk-app-sfdc is using the collection lookup_sfdc_usernames_kvstore which is not defined in the collections.conf of the app, but in the add-on. It looks like the app is trying to refer to that and is not able to find that lookup.

ERROR KVStoreProvider [29936 SchedulerThread] - Could not create KvStore Lookup failed because collection 'lookup_sfdc_usernames_kvstore' in app 'splunk-app-sfdc' does not exist, or user 'splunk-system-user' does not have read access.

Hence my question: Has anyone gotten this to actually work? If so, what is the trick?

Regards.

Mike Kirda

Re: Has anyone gotten the Splunk Salesforce app to work?

amyers16 — Tue, 01 Nov 2022 20:06:41 GMT

Love to know if you get an answer to this as I'm having the same issue.

Re: Has anyone gotten the Splunk Salesforce app to work?

johnhuang — Tue, 01 Nov 2022 20:33:20 GMT

The lookup name is lookup_sfdc_usernames, not lookup_sfdc_usernames_kvstore.

1. Check if you have any data in the lookup:

| inputlookup lookup_sfdc_usernames

If 1 doesn't work:
Check if the above lookup in configured in lookup definition.
Check if the populating search "Lookup - USER_ID to USER_NAME" is scheduled.

Once you have the lookup working, you should modify the dashboards to point to this lookup.

Re: Has anyone gotten the Splunk Salesforce app to work?

amyers16 — Tue, 01 Nov 2022 20:42:30 GMT

At least for me there is no data from the lookup you indicated but to @mkirda1 's point, the error does point to lookup_sfdc_usernames_kvstore. I'll see if I can add a screenshot.

I do have the lookup definition there and it's enabled.

Aaron

Re: Has anyone gotten the Splunk Salesforce app to work?

mkirda1 — Fri, 04 Nov 2022 14:38:30 GMT

Ultimately the dashboards do not work. When I look at the source, this is the query:

index=sfdc eventtype=sfdc-login-history Application=Browser |stats count by UserType| sort - count | eval label=UserType." (".count.")" (I added the index=sfdc to it as this is where the data resides.)

When in the main search and reporting context, I get results.

However when in the Salesforce app context, we see this error:

I do get results in the Search and reporting context, but when I run it in the Salesforce app context, I get the following @johnhuang:

Any help here from someone who has gotten it working would be highly appreciated.

Regards.

Mike Kirda

Re: Has anyone gotten the Splunk Salesforce app to work?

amyers16 — Tue, 08 Nov 2022 18:29:37 GMT

Glad I am not the only one who is having this problem. I've checked permissions all over the app & on the backend and have the same problem. Thanks for the heads up on the dashboards using the wrong index.