Splunk Add-On for Salesforce delayed 1-2 hours?

adelamora — Mon, 06 Mar 2023 14:25:41 GMT

My org has had a problem for awhile now where our Splunk logs pulled from SF are delayed between 1-2 hours. We are using the Splunk Add-On for Salesforce and the delayed logs are coming from ApexCalloutEvent. From speaking to SF and Splunk we were given a few options which I detail below:

1. Research if SF can stream events from the logs to the Splunk HTTP event collector (push).

2. Get with our dev teams and have them take a copy of the Splunk Add-On and customize the parameters for monitoring from hourly to minutes.

I am open to any ideas. I just have not found much on this in forums or the Splunk community.

Re: Splunk Add-On for Salesforce delayed 1-2 hours?

Gr0und_Z3r0 — Tue, 28 Mar 2023 11:49:28 GMT

hi @adelamora

The input configuration for Event Log objects for Salesforce accepts interval in seconds. Based on the volume of data, you can increase the frequency of data collection for the apex events.

interval

Interval

The number of seconds to wait before the Splunk platform runs the command again.

https://docs.splunk.com/Documentation/AddOns/released/Salesforce/Configureinputsv1modular

topic Re: Splunk Add-On for Salesforce delayed 1-2 hours? in Getting Data In

Splunk Add-On for Salesforce delayed 1-2 hours?

Re: Splunk Add-On for Salesforce delayed 1-2 hours?