topic Update Splunk Add-on for Salesforce Streaming API for cloud compatibility in Getting Data In

Update Splunk Add-on for Salesforce Streaming API for cloud compatibility

rjastrze — Wed, 05 Mar 2025 16:45:50 GMT

The current version is not available for the cloud.

According to conversations with Splunk Support, the update addresses a skipped jobs issue when the status on Salesforce REST API tool is at idle.

Please update version 1.0.6 for cloud support compatibility and ensure future updates are cloud compatible.

Re: Update Splunk Add-on for Salesforce Streaming API for cloud compatibility

livehybrid — Wed, 05 Mar 2025 17:21:31 GMT

Hi @rjastrze

As this is a Splunk Works developed app, I think the best approach would be to open a support ticket and request that this be installed on your stack, or ask them to look into having it cloud vetted.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

Re: Update Splunk Add-on for Salesforce Streaming API for cloud compatibility

rjastrze — Wed, 05 Mar 2025 18:31:38 GMT

Thanks Will for your prompt response.

Worked with Splunk Support. Unfortunately, Splunk Support cannot add the TA to cloud because it has not been verified for cloud usage. They also had no means of identifying who were the developers to work with for vetting, and there isn't a link to a repo site for the app.

We have similar thoughts you mention-- we are investigating adding the TA to one of our forwarders. However, we are looking for a more permanent solution.

The TA when it worked on Cloud took advantage of the HEC. The API keys were easily maintained through the TA, and it was centrally located within the HEC UI console. Having it centrally managed through cloud increased accessibility to cloud admins for support (which, in my organization's staffing model, is a larger group than the admins supporting the forwarder.)

Re: Update Splunk Add-on for Salesforce Streaming API for cloud compatibility

rjastrze — Thu, 06 Mar 2025 21:37:14 GMT

Will, I'll give you the karma for this.

Weird how the TA on Splunkbase kicked me out to here.

Could be user error on my part.

Thanks for your help.